# CVE-2026-69642: Microsoft Skype for Business cross-site scripting in web page generation

Source: https://junglewise.ai/threats/cve-2026-69642-microsoft-skype-for-business-cross-site-scripting-in-web-page  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-69642 · Severity: medium · CVSS 6.5 · Published 2026-09-08

Skype for Business is a communication platform used by enterprises for instant messaging, video conferencing, and collaboration. A cross-site scripting (XSS) vulnerability in its web interface could allow an attacker to inject malicious code that executes in users' browsers, potentially enabling account spoofing, credential theft, or unauthorized actions performed on behalf of legitimate users.

Technologies: [Microsoft Skype for Business](https://junglewise.ai/threats/technologies/skype-for-business). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2026-69642 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-69642 being exploited in the wild.

**How severe is CVE-2026-69642?** Medium severity, with a CVSS score of 6.5, published 8 September 2026.

**Which products and versions are affected?** Microsoft Skype for Business.

**Is there a fix for CVE-2026-69642?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-69642 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-69642?** Check whether you run Microsoft Skype for Business. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an improper neutralization of user input during web page generation, resulting in reflected or stored cross-site scripting (XSS). The root cause lies in inadequate input validation or output encoding in Skype for Business's web interface. An attacker can craft a malicious URL or inject payloads that execute arbitrary JavaScript in the victim's browser context, allowing session hijacking, credential capture, or spoofing. The attack is network-accessible and requires social engineering (phishing link) or stored payload placement; no authentication is strictly required for exploitation if the XSS is reflected. Microsoft has released security updates to remediate this issue.

## Affected products

- Microsoft Skype for Business

## Timeline

- 2026-09-08: disclosed

## References

- [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69642](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69642)

## Related threats

- [Microsoft Skype for Business and Lync privilege escalation](https://junglewise.ai/threats/cve-2026-85873-improper-authorization-in-skype-for-business-and-microsoft-lync)
- [Microsoft Skype for Business cryptographic signature spoofing](https://junglewise.ai/threats/cve-2026-69646-microsoft-skype-for-business-cryptographic-signature-spoofing)
- [Microsoft Skype for Business out-of-bounds read](https://junglewise.ai/threats/cve-2026-66308-microsoft-skype-for-business-out-of-bounds-read)
- [Microsoft Skype for Business integer underflow denial of service](https://junglewise.ai/threats/cve-2026-66307-microsoft-skype-for-business-integer-underflow-denial-of-service)
- [Microsoft Skype for Business information disclosure in error messages](https://junglewise.ai/threats/cve-2026-66306-microsoft-skype-for-business-information-disclosure-in-error)