Executive brief
Skype for Business is a communication platform used by enterprises for instant messaging, video conferencing, and collaboration. A cross-site scripting (XSS) vulnerability in its web interface could allow an attacker to inject malicious code that executes in users' browsers, potentially enabling account spoofing, credential theft, or unauthorized actions performed on behalf of legitimate users.
Technical details
The vulnerability is an improper neutralization of user input during web page generation, resulting in reflected or stored cross-site scripting (XSS). The root cause lies in inadequate input validation or output encoding in Skype for Business's web interface. An attacker can craft a malicious URL or inject payloads that execute arbitrary JavaScript in the victim's browser context, allowing session hijacking, credential capture, or spoofing. The attack is network-accessible and requires social engineering (phishing link) or stored payload placement; no authentication is strictly required for exploitation if the XSS is reflected. Microsoft has released security updates to remediate this issue.
Affected products
- Microsoft Skype for Business
Timeline
- 2026-09-08: disclosed