CVE-2026-66302: Skype for Business RCE Vulnerability

CVE-2026-66302 Overview

CVE-2026-66302 is a remote code execution vulnerability in Microsoft Skype for Business. The flaw stems from external control of file name or path [CWE-73], allowing an unauthenticated attacker to execute arbitrary code over a network. Microsoft published the advisory through the Microsoft Security Response Center.

The vulnerability requires no privileges and no user interaction. An attacker with network access to a vulnerable Skype for Business instance can achieve full compromise of confidentiality, integrity, and availability.

Critical Impact

Unauthenticated attackers can execute arbitrary code remotely on affected Skype for Business systems, leading to full system takeover without user interaction.

Affected Products

• Microsoft Skype for Business (refer to the Microsoft Security Update Guide for specific affected versions)

Discovery Timeline

• 2026-09-08 - CVE-2026-66302 published to NVD
• 2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-66302

Vulnerability Analysis

CVE-2026-66302 is classified under [CWE-73]: External Control of File Name or Path. The vulnerability allows an attacker to influence file path parameters processed by Skype for Business. By manipulating file references, the attacker can direct the application to load or execute attacker-controlled content.

Because the attack vector is network-based and requires no authentication or user interaction, exploitation is straightforward once a proof of concept becomes available. The scope is unchanged, meaning the impact is contained within the vulnerable component's security boundary, though that component runs with sufficient privileges to enable code execution on the host.

Root Cause

The root cause is improper validation of file path or file name inputs supplied by external actors. Skype for Business accepts a file reference from a network request and processes it without sufficient constraint on its origin or contents. This allows a remote actor to influence which file the application opens, loads, or executes.

Attack Vector

The attack occurs over the network against exposed Skype for Business services. An unauthenticated attacker crafts a request containing a manipulated file path or filename parameter. The vulnerable code path processes the attacker-controlled value, resulting in arbitrary code execution in the context of the Skype for Business process.

No public proof-of-concept or exploit code has been published at the time of writing. Refer to the Microsoft Security Update Guide for authoritative technical details.

Detection Methods for CVE-2026-66302

Indicators of Compromise

• Unexpected outbound connections from Skype for Business server processes to unfamiliar external hosts or file shares.
• Anomalous child processes spawned by Skype for Business services, particularly command interpreters or scripting engines.
• Log entries showing inbound requests containing UNC paths, encoded traversal sequences, or references to remote file locations.

Detection Strategies

• Monitor Skype for Business server logs for requests containing suspicious file path parameters, including UNC paths (\\attacker\share) and URL-encoded traversal attempts.
• Deploy network detection rules to flag SMB or HTTP fetches initiated by Skype for Business processes toward untrusted destinations.
• Correlate authentication logs with file access telemetry to identify unauthenticated requests triggering file operations.

Monitoring Recommendations

• Enable process creation auditing on Skype for Business servers and forward events to a centralized SIEM for correlation.
• Track outbound SMB (TCP 445) and WebDAV traffic originating from Skype for Business hosts, which is unusual under normal operation.
• Baseline typical Skype for Business network behavior and alert on deviations, particularly connections to internet-facing IPs.

How to Mitigate CVE-2026-66302

Immediate Actions Required

• Apply the security update referenced in the Microsoft Security Update Guide to all affected Skype for Business deployments.
• Restrict network exposure of Skype for Business servers to trusted network segments and required client ranges.
• Inventory all Skype for Business instances, including on-premises servers and edge deployments, to ensure complete patch coverage.

Patch Information

Microsoft has released a security update addressing CVE-2026-66302. Administrators should consult the Microsoft Security Update Guide for the specific KB articles, supported build versions, and deployment instructions applicable to their Skype for Business environment.

Workarounds

• Block outbound SMB (TCP 445) traffic from Skype for Business servers to the internet at the perimeter firewall to limit remote file retrieval.
• Place Skype for Business servers behind a reverse proxy or application-layer gateway that filters malformed file path parameters.
• Disable or restrict federation and external access features until the patch is applied if the deployment does not require them.

# Example: Block outbound SMB from Skype for Business servers at the Windows firewall
New-NetFirewallRule -DisplayName "Block Outbound SMB 445" `
  -Direction Outbound `
  -Protocol TCP `
  -RemotePort 445 `
  -Action Block `
  -Profile Any