Microsoft Teams CVE-2026-65667

No special conditions - remote unauthenticated network exploitation against Microsoft Teams, per the CVSS vector AV:N/AC:L/PR:N/UI:N (no authentication, no user interaction, low attack complexity). The only inherent limiting factor is network reachability of the vulnerable Teams service endpoint; the scope change (S:C) means successful exploitation impacts resources governed by a separate security authority. The precise feature, API, or configuration that triggers the missing authorization check is not detailed in the available data and should be confirmed via the MSRC advisory.

The signals are strongly aligned toward high priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H) describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction and a scope change, yielding the maximum 10.0 base score. Against that, the exploitation-likelihood signals are quiet - the vulnerability is not in CISA KEV and no public POC or exploit code was provided, so there is no evidence of active exploitation and (no EPSS value was supplied to quantify probability). This is a genuine priority driven by ease and impact of exploitation rather than by observed in-the-wild activity; the absence of KEV/POC data reflects analysis-time intelligence, not a guarantee the flaw is hard to weaponize. One caveat: the description characterizes the outcome as 'elevate privileges' while the CVSS impact is scored as confidentiality/integrity with no availability effect and a scope change - verify with the MSRC advisory whether this is an authorization-bypass leading to cross-tenant/cross-user access versus a classic role escalation.

A remote attacker with network access to the Teams service sends a crafted request to an API or action that fails to verify authorization, invoking functionality reserved for a privileged role or another tenant/user. Because no authentication, user interaction, or special complexity is required and scope is changed, the attacker gains high-impact read/modify access to resources outside the originally exposed component. No public exploit code is identified at time of analysis.