Executive brief
Skype for Business contains a vulnerability where error messages may reveal sensitive information to unauthenticated attackers over the network. An attacker can trigger specific errors and extract confidential data from the responses, potentially compromising account details or system configuration information without requiring authentication.
Technical details
Skype for Business generates error messages that inadvertently disclose sensitive information accessible to unauthenticated network attackers. The vulnerability is an information disclosure flaw stemming from improper error message handling, where detailed error responses leak confidential data such as internal configuration or user information. No authentication is required to trigger the vulnerable error condition—an attacker can send specially crafted network requests to elicit sensitive information in the error response. The attack is purely informational and does not enable direct compromise of accounts or systems, but facilitates reconnaissance for further attacks. Patch availability and specific affected versions are not detailed in the advisory summary; refer to the Microsoft Security Response Center update guide for remediation timelines.
Affected products
- Microsoft Skype for Business <UNKNOWN>
Timeline
- 2026-09-08: disclosed