CVE-2026-65812

CVE-2026-65812 is an information disclosure flaw (CWE-201) in Microsoft Teams for Android in which the client inserts sensitive information into data it sends over the network. Per the CVSS vector, an authorized (authenticated, low-privilege) attacker can trigger the condition, user interaction is required, and the changed-scope metric indicates the sensitive data crosses a security boundary to another trust zone. A successful exploit discloses confidential information, with no impact on data integrity or availability. Only users running the Android Teams client are named as affected; other Teams platforms are not specified in this data. No public proof-of-concept or in-the-wild exploitation is known, and EPSS estimates only about a 0.5% chance of exploitation within 30 days.

What to do: Update Microsoft Teams for Android to the latest build distributed via Google Play (or via Intune/MDM-managed app updates) and verify installed client versions on managed devices. Because exploitation requires an authenticated attacker and user interaction, prioritize patching users who handle highly sensitive data. Monitor Microsoft's advisory for the specific fixed version, which is not stated in this data.