What is the CVSS score of CVE-2026-65667?

CVE-2026-65667 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.5%.

Which versions of Microsoft Teams are affected by CVE-2026-65667?

CVE-2026-65667 is a critical, unauthenticated privilege escalation vulnerability in Microsoft Teams (CVSS 10.0) that exposes all organizational users and connected corporate resources to unauthorized…

How to fix or mitigate CVE-2026-65667?

Within 24 hours, conduct an urgent inventory of Teams deployment scope (user count, linked integrations, dependent business functions) and activate enhanced logging and real-time security monitoring to establish a baseline for detecting exploitation attempts. Within 7 days, implement network segmentation to isolate Teams infrastructure from critical corporate resources, restrict Teams administrative access to a minimal set of privileged users, and audit Teams app integrations to disable non-essential permissions that could amplify privilege escalation impact. Within 30 days, establish continuous monitoring for exploitation indicators, maintain a rapid incident response plan specific to Teams compromise, coordinate with Microsoft for patch-release timelines, and evaluate alternative communication platforms to reduce organizational dependence on Teams pending security patch availability.

Microsoft Teams CVE-2026-65667

EUVD-2026-54322 CRITICAL

Missing Authorization (CWE-862)

2026-08-07 secure@microsoft.com

GHSA-qf3x-g8x3-rcjc

Authentication Bypass Microsoft Teams

10.0

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

ENISA EUVD

CRITICAL

qualitative

vuln.today AI

10.0 CRITICAL

Missing authorization is network-reachable and unauthenticated with no user interaction (AV:N/AC:L/PR:N/UI:N); scope changes across security authorities (S:C) with high C/I and no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 00:35 vuln.today

CVE Published

Aug 07, 2026 - 00:16 nvd

CRITICAL 10.0

DescriptionCVE.org

Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network.

AnalysisAI

Privilege elevation in Microsoft Teams lets a remote, unauthenticated attacker gain unauthorized access across a network due to a missing authorization check (CWE-862). The maximum 10.0 CVSS rating stems from a changed scope with high confidentiality and integrity impact, meaning the flaw reaches resources beyond the initially vulnerable component. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the perfect-score, no-precondition profile makes it a top-tier patch priority.

Technical ContextAI

Microsoft Teams is Microsoft's collaboration and communication platform, delivered as a cloud service integrated with Microsoft 365/Entra ID and consumed through web, desktop, and mobile clients. The root cause is CWE-862 (Missing Authorization): a code path that performs a sensitive action without verifying that the requesting principal is entitled to perform it, allowing an actor to invoke privileged functionality reserved for higher-trust roles. Because the CVSS vector marks scope as changed (S:C), the authorization gap in the vulnerable Teams component grants access to resources managed by a separate security authority - consistent with a service-side authorization bypass rather than a local client bug. No CPE strings were supplied, so exact affected build identifiers are not enumerable from the provided data; the single MSRC reference indicates this is a Microsoft-serviced (likely cloud-fixed) vulnerability.

RemediationAI

Consult the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65667 for the authoritative fix and servicing status; for cloud-serviced Teams components Microsoft typically deploys the correction on the service side with no customer action required, while any client-side updates should be applied by ensuring Teams desktop/mobile clients auto-update to the latest build. Patch available per vendor advisory (exact fixed version not specified in the provided data - do not assume a build number). As interim risk reduction pending confirmation of the fix scope, restrict Teams exposure to trusted, authenticated Entra ID identities, enforce Conditional Access and MFA, review external/guest access and federation settings, and monitor Teams and Microsoft 365 audit logs for anomalous privileged actions; note these controls reduce but may not fully eliminate a server-side authorization bypass, so confirming Microsoft's remediation is the primary control.