DEV Community

StarkMan
StarkMan

Posted on

CVE-2026-66302: External Path Control in Skype for Business Server

#windows #unifiedcommunications #pathtraversal #rce

CVE-2026-66302: External Path Control in Skype for Business Server

On-premises Skype for Business Server still carries internal telephony for a lot of enterprises. CVE-2026-66302 is an unauthenticated remote code execution flaw in it, rooted in how the product handles file names and paths it does not control.

What the record says

NVD describes CVE-2026-66302 as external control of file name or path in Skype for Business allowing an unauthorized attacker to execute code over a network. The weakness is CWE-73 and the CVSS base score is 9.8. It was published on 8 September 2026.
An unauthenticated, network-reachable path-handling flaw in a communications server is an uncomfortable shape, the server exists to accept connections from outside, and it has a documented history of this bug class.

Why path control becomes code execution

CWE-73 is the parent of a family that includes path traversal and unsafe file reference. In a server product, the concern is where the attacker's value ends up being used. If a name or path derived from a request reaches a file operation, or reaches a component that loads content, the attacker gains influence over what the server reads or executes.
The CVSS vector matters here for a practical reason. With no privileges and no user interaction required and a network attack vector, the only remaining question is whether the instance is reachable and unpatched.

The deployment reality

Skype for Business Server is almost never the newest component in the estate. It is frequently the application that survived a migration because the conference dial-in numbers still work, and it is frequently running on an operating system version that has been maintained only reluctantly. That combination is why a path-handling flaw here deserves a fast response.
It is also a server that tends to be internet-facing by design, with edge components published for external access. The edge role is the exposure path.

Handling

Apply the September 2026 updates, and prioritise any server with an edge role. Confirm the patch actually landed on the edge and on the front-end pool rather than only on the internal pool that the update tool happened to reach.
Then reduce what is externally published. If the deployment does not require external access for conferencing or federation, unpublish the edge interfaces and remove the DNS records that point to them. A service that no longer needs to be reachable is a service whose parsing flaws stop mattering.
Finally, monitor the application's own logs for requests containing unusual path syntax. For a CWE-73 flaw the signal is a request whose parameters look like file references rather than the structured values the API expects.

References

Top comments (0)