What is the CVSS score of CVE-2026-32185?

CVE-2026-32185 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-32185?

Yes, a patch is available for CVE-2026-32185. Update the affected software to the latest version immediately.

Microsoft Teams CVE-2026-32185

EUVD-2026-29573 MEDIUM

Files or Directories Accessible to External Parties (CWE-552)

2026-05-12 microsoft

GHSA-cj9x-63fv-gcxg

Information Disclosure Path Traversal Microsoft Microsoft Teams For Android

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

ENISA EUVD

HIGH

qualitative

vuln.today AI

5.5 MEDIUM

Local vector with no required privileges matches Android co-app access model; UI:R reflects Teams must be active; C:H reflects full file exposure; no integrity or availability impact confirmed.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 21:36 vuln.today

CVE Published

May 12, 2026 - 16:59 nvd

MEDIUM 5.5

DescriptionCVE.org

Files or directories accessible to external parties in Microsoft Teams allows an unauthorized attacker to perform spoofing locally.

AnalysisAI

Microsoft Teams for Android exposes internal files or directories to unauthorized local parties via CWE-552 (Files or Directories Accessible to External Parties), enabling a local attacker to perform identity spoofing. Affected versions span all releases of Teams for Android below 1.0.0.2026092103. No public exploit code has been identified and CISA has not added this to the Known Exploited Vulnerabilities catalog, though the SSVC framework rates the technical impact as total, suggesting that successfully accessed data could fully compromise the Teams session or identity context on the device.

Technical ContextAI

CWE-552 describes a class of flaws where an application stores sensitive files or directories in locations accessible to other processes, users, or applications outside its intended trust boundary. On Android, this commonly manifests as insecure use of external shared storage (e.g., /sdcard or Android's MediaStore) instead of app-private internal storage, world-readable file permissions on sensitive data, or path traversal vulnerabilities that allow navigation outside the app's sandbox. The Tags field includes 'Path Traversal', indicating the exposure mechanism may involve insufficient path validation. The CPE cpe:2.3:a:microsoft:microsoft_teams_for_android:*:*:*:*:*:*:*:* confirms the flaw is specific to the Android client. CVSS AV:L with PR:N suggests a co-resident malicious app (without elevated privileges) or physical device access can reach the exposed files without needing Android permissions granted to Teams itself.

RemediationAI

Update Microsoft Teams for Android to version 1.0.0.2026092103 or later, which contains the vendor-released patch per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32185. The update is available via the Google Play Store. As a compensating control where immediate patching is not possible, organizations can restrict app sideloading and enforce managed device policies (MDM/MAM) that prevent untrusted co-resident applications from accessing shared storage - this reduces the attack surface for the PR:N, AV:L vector. Note that MDM controls do not eliminate the risk of physical device access by a local attacker.