What is the CVSS score of CVE-2026-42835?

CVE-2026-42835 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Microsoft Teams are affected by CVE-2026-42835?

A high-severity information disclosure vulnerability in Microsoft Teams for Android (CVE-2026-42835, CVSS 8.1) allows authenticated attackers to extract sensitive organizational data from mobile…. A patch is available.

How to fix or mitigate CVE-2026-42835?

Within 24 hours: Alert Teams administrators and identify all Android Teams users in your environment; assess which communications contain sensitive data; contact Microsoft support for additional advisory information. Within 7 days: Deploy MDM policy restrictions limiting Teams for Android access to essential business users only; require device compliance verification and enable enhanced logging. Within 30 days: Monitor Microsoft security advisories for patch availability; upon release of a patched Teams version for Android, immediately test and deploy to all managed devices.

Microsoft Teams CVE-2026-42835

EUVD-2026-35535 HIGH

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-06-09 secure@microsoft.com

GHSA-mqcp-h3mm-5h8v

Information Disclosure Google Microsoft Teams

8.1

CVSS 3.1 · NVD

Temporal: 7.1

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

7.1 HIGH

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jun 09, 2026 - 19:03 EUVD

Analysis Generated

Jun 09, 2026 - 17:38 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 8.1

DescriptionNVD

Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Teams for Android allows an authorized attacker to disclose information over a network.

AnalysisAI

Information disclosure in Microsoft Teams for Android allows an authenticated remote attacker to extract sensitive data via an injection flaw (CWE-74) in output passed to a downstream component. The CVSS 8.1 rating reflects high confidentiality and availability impact over the network with low privileges and no user interaction, though no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.

Technical ContextAI

The root cause is CWE-74 (improper neutralization of special elements in output used by a downstream component), commonly known as an injection weakness. In the context of the Teams Android client, this means data flowing from the app into a downstream consumer (likely a parser, renderer, IPC channel, or backend service) is not properly sanitized, allowing crafted input to alter the semantics of that downstream channel. Microsoft Teams for Android is a mobile collaboration client that communicates with Microsoft 365 backend services over HTTPS and interacts with on-device components (WebView, Android intents, content providers), any of which could be the downstream sink being exploited.

RemediationAI

Patch available per vendor advisory - update Microsoft Teams for Android to the latest version distributed through the Google Play Store as referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42835; the exact fixed version is not enumerated in the provided intelligence and must be retrieved from that MSRC page. As a compensating control until updates roll out across the fleet, enforce mobile device management (MDM) policies to mandate auto-updates for the Teams app on managed Android devices, and consider conditional-access policies that block older Teams client versions from connecting to tenant resources - this trades off availability for users on outdated clients in exchange for blocking the vulnerable surface. Restricting Teams external federation and guest-access settings can also limit which low-privileged attackers can reach a victim tenant, though it does not remove the underlying flaw.