CVE-2026-83746: Skype for Business Privilege Escalation

CVE-2026-83746 Overview

CVE-2026-83746 is an absolute path traversal vulnerability affecting Microsoft Skype for Business and Microsoft Lync. An authenticated attacker can exploit the flaw over a network to elevate privileges on the target server. The weakness is tracked under CWE-36: Absolute Path Traversal and allows manipulation of file paths that reference locations outside the intended directory scope.

Microsoft published the advisory in the Microsoft Security Update Guide. The vulnerability requires low-level privileges but no user interaction, making it attractive for post-authentication lateral movement in enterprise collaboration environments.

Critical Impact
An authenticated network attacker can leverage absolute path traversal in Skype for Business or Microsoft Lync to elevate privileges, with high impact to integrity and availability.

Affected Products

Microsoft Skype for Business
Microsoft Lync
Specific version data not published in the NVD entry at time of writing

Discovery Timeline

2026-10-13 - CVE CVE-2026-83746 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-83746

Vulnerability Analysis

The vulnerability is an absolute path traversal issue in Skype for Business and Microsoft Lync. The affected components accept file path input that is not properly constrained to an intended base directory. An attacker who supplies an absolute path can direct file operations toward arbitrary filesystem locations.

Because the attack vector is network-based and requires only low privileges, any authenticated user able to reach the service endpoint can attempt exploitation. Successful exploitation yields privilege elevation on the target system, with high impact to integrity and availability but no direct impact to confidentiality.

The EPSS probability stands at 1.013% as of 2026-10-14, placing the vulnerability in the upper third of scored CVEs for near-term exploitation likelihood.

Root Cause

The root cause is improper validation of file path inputs within request handlers in Skype for Business and Lync server components. The affected code paths treat caller-supplied absolute paths as trusted, bypassing directory canonicalization checks that would otherwise restrict access to a safe working directory. This condition maps to CWE-36: Absolute Path Traversal.

Attack Vector

An attacker authenticates to the Skype for Business or Lync service over the network. The attacker then submits a request containing an absolute file path targeting a privileged resource. The server processes the path without enforcing a base directory restriction, enabling the attacker to read, write, or replace files tied to higher-privileged contexts. The outcome is elevation of privileges on the host.

No public proof-of-concept exploit, exploit database entry, or vendor-published exploitation detail was available at the time of writing. Refer to the Microsoft Security Update Guide for authoritative technical details.

Detection Methods for CVE-2026-83746

Indicators of Compromise

Unexpected file writes under Skype for Business or Lync service account contexts targeting system directories such as C:\Windows\System32 or service configuration folders.
Authenticated requests to Skype for Business or Lync endpoints containing absolute path strings (for example, paths beginning with a drive letter or UNC prefix) in parameters that should accept filenames only.
New or modified service binaries, DLLs, or configuration files on Lync or Skype for Business servers without a corresponding change-management record.

Detection Strategies

Inspect application and IIS logs on Skype for Business and Lync servers for request parameters containing :\\, \\?\, or UNC paths in fields expected to carry relative filenames.
Correlate authenticated session events with subsequent file system modifications under the Skype for Business or Lync service account.
Enable file integrity monitoring on Lync and Skype for Business installation directories to flag unauthorized writes.

Monitoring Recommendations

Forward Lync and Skype for Business server logs, Windows Security logs, and Sysmon file-create events to a central analytics platform for correlation.
Alert on privilege escalation signals such as new local administrators, service account token manipulation, or scheduled task creation on affected servers.
Baseline normal file-write activity for Lync service processes and alert on deviations.

How to Mitigate CVE-2026-83746

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all Skype for Business and Lync servers.
Inventory on-premises Skype for Business and Lync deployments and prioritize internet-exposed or multi-tenant servers for patching.
Restrict network reachability to Skype for Business and Lync administrative endpoints to trusted management networks.
Review authentication logs for anomalous account activity preceding the patch window.

Patch Information

Microsoft has published guidance and update packages through the Microsoft Security Update Guide. Administrators should consult the advisory for the specific cumulative updates applicable to their Skype for Business Server or Lync Server version and deploy them following standard change-control procedures.

Workarounds

Enforce least-privilege access on Skype for Business and Lync service accounts to limit the blast radius if exploitation occurs.
Segment Lync and Skype for Business servers from general user networks and require VPN or jump-host access for administrative traffic.
Monitor for and block requests containing absolute path syntax at upstream reverse proxies or web application firewalls until patches are applied.

bash

# Example WAF rule concept to block absolute path patterns in request parameters
# Replace <endpoint> with the specific Skype for Business or Lync URI path
SecRule ARGS "@rx (?i)([a-z]:\\\\|\\\\\\\\|\\\\\\?\\\\)" \
    "id:1008374,phase:2,deny,status:400,msg:'Absolute path in parameter - CVE-2026-83746'"