EUVD-2026-29573
GHSA-cj9x-63fv-gcxg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall malicious co-resident Android app
-
DeliveryUser opens Microsoft Teams (UI:R trigger)
-
ExploitAccess externally-exposed Teams directory
-
ExecutionRead sensitive files or tokens
-
ImpactLeverage data to spoof Teams identity
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling File access restriction
MITRE ATT&CK
2 techniques across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local access to the target Android device, either via a co-resident malicious application or physical device access. The attacker needs no special Android permissions (PR:N), meaning a standard unprivileged app may be sufficient to reach the exposed directories. User interaction is required (UI:R), likely meaning the victim must open or actively use Microsoft Teams so that the vulnerable files are written or accessible at exploit time. The flaw does not apply to Teams clients on other platforms (Windows, macOS, iOS) based on available CPE data. Integrity and availability of Teams data are not impacted - only confidentiality of exposed files or directories. Non-rooted devices with enforced app sandboxing may limit, but per the CVSS PR:N rating do not fully prevent, exploitation. |
| Impact | The NVD CVSS 5.5 (Medium) reflects local attack vector (AV:L), low complexity (AC:L), no required privileges (PR:N), but mandatory user interaction (UI:R) and no integrity or availability impact - only high confidentiality loss. The EPSS score of 0.04% (12th percentile) is very low, consistent with SSVC's 'Exploitation: none' rating, indicating no observed or anticipated mass exploitation. However, the SSVC 'Technical Impact: total' flag stands in tension with the CVSS C:H/I:N/A:N vector - SSVC may be assessing worst-case data exposure (e.g., authentication tokens granting full account access) rather than the direct file-read impact alone. The 'not automatable' SSVC rating aligns with the UI:R requirement. Overall this is a medium-severity, low-urgency issue with no active exploitation signals; the primary risk is targeted attacks on high-value individuals where physical or co-app access to an Android device is feasible. |
| Exploit ScenarioDerived | A malicious application installed on the same Android device - requiring no special permissions beyond standard storage access - waits for the user to open Microsoft Teams (satisfying the UI:R requirement). The malicious app then traverses or directly reads Teams files stored in an externally accessible directory, extracting authentication tokens or profile data. This data is used to spoof the victim's Teams identity, potentially enabling impersonation in communications or session hijacking. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Microsoft Teams for Android exposes internal files or directories to unauthorized local parties via CWE-552 (Files or Directories Accessible to External Parties), enabling a local attacker to perform identity spoofing. Affected versions span all releases of Teams for Android below 1.0.0.2026092103. No public exploit code has been identified and CISA has not added this to the Known Exploited Vulnerabilities catalog, though the SSVC framework rates the technical impact as total, suggesting that successfully accessed data could fully compromise the Teams session or identity context on the device.
RemediationAI
Update Microsoft Teams for Android to version 1.0.0.2026092103 or later, which contains the vendor-released patch per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32185. The update is available via the Google Play Store. As a compensating control where immediate patching is not possible, organizations can restrict app sideloading and enforce managed device policies (MDM/MAM) that prevent untrusted co-resident applications from accessing shared storage - this reduces the attack surface for the PR:N, AV:L vector. Note that MDM controls do not eliminate the risk of physical device access by a local attacker.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-552 describes a class of flaws where an application stores sensitive files or directories in locations accessible to other processes, users, or applications outside its intended trust boundary. On Android, this commonly manifests as insecure use of external shared storage (e.g., /sdcard or Android's MediaStore) instead of app-private internal storage, world-readable file permissions on sensitive data, or path traversal vulnerabilities that allow navigation outside the app's sandbox. The Tags field includes 'Path Traversal', indicating the exposure mechanism may involve insufficient path validation. The CPE cpe:2.3:a:microsoft:microsoft_teams_for_android:*:*:*:*:*:*:*:* confirms the flaw is specific to the Android client. CVSS AV:L with PR:N suggests a co-resident malicious app (without elevated privileges) or physical device access can reach the exposed files without needing Android permissions granted to Teams itself.
Know when Microsoft Teams For Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Local vector with no required privileges matches Android co-app access model; UI:R reflects Teams must be active; C:H reflects full file exposure; no integrity or availability impact confirmed.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Files or directories accessible to external parties in Microsoft Teams allows an unauthorized attacker to perform spoofing locally.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB