CVE-2026-83784: Windows EFS Path Traversal Vulnerability

CVE-2026-83784 Overview

CVE-2026-83784 is an absolute path traversal vulnerability [CWE-36] in the Windows Encrypting File System (EFS). An authorized attacker on the network can exploit this flaw to elevate privileges on an affected system. The vulnerability allows manipulation of file paths through EFS operations, enabling access to resources outside the intended directory boundaries.

Critical Impact
An authenticated network attacker can achieve privilege escalation with high impact to confidentiality, integrity, and availability on vulnerable Windows systems running EFS.

Affected Products

Microsoft Windows (Encrypting File System component)
Specific version information is published in the Microsoft Security Update Guide
Refer to the Microsoft CVE-2026-83784 Update Guide for the authoritative affected build list

Discovery Timeline

2026-10-13 - CVE-2026-83784 published to the National Vulnerability Database
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-83784

Vulnerability Analysis

The vulnerability resides in how the Windows Encrypting File System processes file path inputs during remote operations. EFS is a Windows feature that provides transparent file-level encryption on NTFS volumes. The service accepts path parameters from authenticated callers and resolves them without sufficient restriction on absolute path references.

An attacker with valid network credentials can send crafted EFS requests that reference absolute file paths outside the expected scope. Because the service operates with elevated privileges, successful traversal leads to unauthorized access or modification of protected files. This condition enables the attacker to escalate privileges on the target host.

Root Cause

The root cause is improper neutralization of absolute path components in file references passed to the EFS subsystem. Classified under [CWE-36] (Absolute Path Traversal), the flaw occurs when the service trusts caller-supplied paths rather than canonicalizing and validating them against an allowlist of permitted locations.

Attack Vector

Exploitation requires network access and low-privilege authenticated credentials, with no user interaction. The attacker sends specially crafted EFS protocol requests containing absolute paths that reference sensitive system locations. Successful exploitation yields code execution or file manipulation in a higher-privileged context. Microsoft has not published public proof-of-concept code, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical specifics are available in the Microsoft CVE-2026-83784 Update Guide.

Detection Methods for CVE-2026-83784

Indicators of Compromise

Unusual EFS Remote Procedure Call (RPC) traffic originating from non-administrative accounts
Access attempts referencing absolute paths to system directories such as C:\Windows\System32 through EFS operations
Unexpected file reads, writes, or encryption operations performed by the lsass.exe process acting on behalf of standard users
New or modified files in privileged locations with timestamps aligned to authenticated EFS sessions

Detection Strategies

Monitor Windows Security Event Log IDs 4624 and 4672 for anomalous logon patterns followed by EFS activity
Enable auditing of file system object access on sensitive directories to capture traversal attempts
Inspect RPC endpoints bound to the EFS interface for requests originating from unexpected source hosts
Correlate authentication events with subsequent privilege-sensitive file operations across endpoints

Monitoring Recommendations

Baseline normal EFS usage within the environment and alert on deviations in volume or source
Forward Windows event telemetry to a centralized analytics platform for cross-host correlation
Alert on access to high-value files by accounts without a legitimate business need

How to Mitigate CVE-2026-83784

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-83784 Update Guide to all affected Windows systems
Prioritize patching domain controllers, file servers, and any host where EFS is actively used
Audit accounts with network logon rights and revoke unnecessary access
Review recent EFS-related activity logs for signs of exploitation prior to patching

Patch Information

Microsoft has released a security update addressing CVE-2026-83784. Administrators should consult the Microsoft Security Update Guide for the specific Knowledge Base article numbers corresponding to each affected Windows build. Deploy the update through Windows Update, Windows Server Update Services (WSUS), or an enterprise patch management solution.

Workarounds

Restrict network access to EFS RPC endpoints using host-based or network firewalls where EFS is not required
Disable the Encrypting File System service on systems that do not depend on it, following Microsoft guidance
Enforce the principle of least privilege for user accounts to reduce the pool of potential authenticated attackers
Segment networks to limit lateral movement from workstations to servers hosting sensitive data

bash

# Example: Query EFS service status on a Windows host
sc.exe query EFS

# Example: Restrict RPC access to specific administrative subnets via firewall
New-NetFirewallRule -DisplayName "Restrict EFS RPC" -Direction Inbound -Protocol TCP -LocalPort 135 -RemoteAddress 10.0.0.0/24 -Action Allow