PULSEUnderground Intel

LIVE23signals / 24h

FEED

ransomakira reclama a Videk · GB · Technologyransomakira reclama a Boyle, Pecharich, Cline, Whittington and Stallings · Professional Servicesransom0x00 reclama a bienestarempresarial · MX · Professional Servicesransomiah6477 reclama a middleby · US · Manufacturingransomiah6477 reclama a sunshine-mills · Agriculture and Food Productionransomakira reclama a Svd (Sun Valley Dairy) · US · Agriculture and Food Productionransomqilin reclama a Hocon Gas · NG · Energy & Utilitiesransomqilin reclama a HyperGen · US · Technologyransomqilin reclama a Chattanooga Shooting Supplies · US · Retail & E-Commerceransomqilin reclama a Brame Telecom · BR · Technologyransomiah6477 reclama a hensley · Otherransomvexy ransomware reclama a Enchanted Fine Jewellery · IN · Retail & E-Commerceransomiah6477 reclama a buckle · Retail & E-Commerceransomiah6477 reclama a camden-living · GB · Hospitalityransomakira reclama a Videk · GB · Technologyransomakira reclama a Boyle, Pecharich, Cline, Whittington and Stallings · Professional Servicesransom0x00 reclama a bienestarempresarial · MX · Professional Servicesransomiah6477 reclama a middleby · US · Manufacturingransomiah6477 reclama a sunshine-mills · Agriculture and Food Productionransomakira reclama a Svd (Sun Valley Dairy) · US · Agriculture and Food Productionransomqilin reclama a Hocon Gas · NG · Energy & Utilitiesransomqilin reclama a HyperGen · US · Technologyransomqilin reclama a Chattanooga Shooting Supplies · US · Retail & E-Commerceransomqilin reclama a Brame Telecom · BR · Technologyransomiah6477 reclama a hensley · Otherransomvexy ransomware reclama a Enchanted Fine Jewellery · IN · Retail & E-Commerceransomiah6477 reclama a buckle · Retail & E-Commerceransomiah6477 reclama a camden-living · GB · Hospitality

CVE WatchOct 13, 2026

CVE-2026-83784

Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges over a network.

CVSS

8.8

High

EPSS

1.0%

p61

KEV

—

Exploit Today

18

0-100

Published: Oct 13, 2026 · Last modified: Oct 13, 2026 · CWE-36

EPSS · 30d

Not enough EPSS history yet.

Technical description

Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges over a network.

Official references

msrc.microsoft.comhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83784

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-837468.1 HIG

——19Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.2d CVE-2026-836836.5 MED

——20Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information over a network.2d CVE-2026-702978.8 HIG

——19Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to execute code over a network.2d CVE-2026-55062—

——2uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with the selected hooks directory, allowing parent-directory components to escape that directory. The resulting path is passed to the configured editor, which can access or modify files outside the hooks directory with the privileges of the uniget process account. This issue is fixed in version 0.27.6.22d CVE-2025-708203.5 LOW

——2Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders other than the personal folder.23h CVE-2026-890099.1 CRI

——19WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote attackers to overwrite any file on the device by sending a crafted payload to the sync_server daemon on TCP port 13136. The daemon, which runs as root and requires no authentication, accepts a 100-byte filename field in its protocol header without path canonicalization, allowing attackers to supply an absolute path and write arbitrary content to overwrite startup scripts or credential stores to achieve persistent system compromise.30d