CVE-2026-65812

Microsoft Teams for Android Information Disclosure Vulnerability

No known exploitation. EPSS puts it in the 58th percentile. No fix published yet.

CVSS 3.16.8Medium EPSS percentile58th0.9% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-09-08Updated 2026-09-15Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether your staff use Microsoft Teams for Android and identify its installed version.
Update Microsoft Teams for Android to version 1.0.0.2026133602 or later through your managed app system or Google Play.
Until all devices are updated, limit sending sensitive information through the Android app on networks where traffic could be observed.

Vendor advisory Usually a quick update

What it is

From the CVE record

Insertion of sensitive information into sent data in Microsoft Teams for Android allows an authorized attacker to disclose information over a network.

In plain language

Written by AI from the record

Microsoft Teams for Android before 1.0.0.2026133602 may leak private details while users send data, so businesses using it should update promptly.

Authenticated network-based information disclosure caused by sensitive information being inadvertently included in data sent from Microsoft Teams for Android after user action.

If you're affected

Private information exposure
Employee data disclosure
Customer detail exposure
Loss of business confidentiality

What is it

This is a privacy flaw in the Android Teams app. It is like accidentally putting private notes inside an envelope: the intended message may arrive normally, but someone able to inspect it in transit can see details that were not meant for them.

Who is affected

This matters to you if your staff use Microsoft Teams for Android to send messages or files containing personal or business-sensitive information. It only becomes a risk when a user initiates sending data and an authorized attacker can view the network traffic.

How urgent is it

A person able to observe network traffic can obtain private details sent by affected Android Teams users, which makes this a high-priority update. There is no confirmed public exploitation, no public exploit code, and it is not listed in CISA's known-exploited catalog, but affected devices should be remediated now.

What to do — in detail

Inventory managed and unmanaged Android devices that run Microsoft Teams for Android, then verify the installed app version.
Upgrade every affected device to Microsoft Teams for Android 1.0.0.2026133602 or later using Google Play, Android enterprise management, or your mobile-device-management platform.
The findings provide one fixed version and do not identify separate release branches or a breaking-change requirement; validate the update with a small device group if your mobile-management process requires it.
If upgrading is delayed, keep sensitive data out of messages and file transfers made through the Android app, especially on networks where traffic may be visible to others.
No CISA KEV remediation due date applies because this CVE is not listed in KEV. Review device update compliance and investigate reports of unexpected exposure of data sent from Android Teams.

Technical context

CVE-2026-65812 is CVSS 6.8 (Medium): CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N. It is CWE-201, involving sensitive information being included in sent data; exploitation requires authentication, user action that initiates sending, and an attacker able to observe network traffic. It is not reachable in the default configuration. CISA KEV does not list it, no public exploit code is recorded, and no dated reporting confirms exploitation. EPSS is 0.5% (41st percentile) with a flat trend.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS58th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.9% chance of exploitation activity in the next 30 days, which ranks it in the 58th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Rising, driven by in-the-wild reports.

Lifecycle

5 events over 7 days, from the signal feeds we watch.

2026-09-15Record updated
2026-09-08Publishedweakness classified, record updated, record updated

Affected products

Microsoftcommercial · US
- Microsoft Teams for AndroidOn-premOperating Systems / windows

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Scored 6.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity NoneNo integrity impact
Availability NoneNo availability impact

Weaknesses

CWE-201No name in the record

Sources

References in the record

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65812

In the news

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Microsoft, not every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account