Microsoft Teams CVE-2026-65768

The target must be running Microsoft Teams for Android at a version below 1.0.0.2026133602, and the attacker must be able to deliver crafted content (a message, attachment, or shared file with a manipulated pathname) that the victim's client processes - feasible for any party able to reach the user via Teams chat, channel, or external federation. Microsoft's CVSS vector states no privileges (PR:N) and no user interaction (UI:N), so no authentication on the victim's account is required to send the payload; however, because this is a client-side flaw in a mobile chat app, exploitation is in practice bounded by the victim actually receiving and having the app render/handle the malicious content, and by the specific vulnerable version range - a limiting factor defenders should weigh against the raw 9.8. The UI:N claim is worth verifying against MSRC, as client-side RCE of this type frequently requires at least the victim viewing the delivered content.

The signals conflict, and the honest read is 'patch promptly but not a fire drill.' The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) and 9.8 score imply trivial, unauthenticated, no-interaction network RCE - yet the corroborating exploitation signals are weak: EPSS 0.62% (47th percentile) is low, and CISA's SSVC framework reports Exploitation: none and Automatable: no, while agreeing Technical Impact is total. There is no KEV listing and no public exploit identified at time of analysis, so the 9.8 reflects worst-case impact rather than demonstrated ease of attack. A notable tension: the vector claims UI:N, but a path-traversal-to-RCE in a mobile chat client realistically depends on the victim's app receiving and processing attacker-delivered content, which often implies some user interaction - this should be verified against Microsoft's MSRC guidance. Given Teams' large install base, the prudent posture is that any organization running the Android client should treat patching as urgent even though there is no evidence of mass exploitation, and even a mid-sized municipal IT team should not defer the update simply because EPSS is low. Net: high potential impact, currently low observed exploitation - prioritize the fix on a normal-but-expedited cycle.

An attacker sends a specially crafted message, attachment, or shared file through Teams containing path-traversal sequences in a filename or path field; when a targeted user's vulnerable Android client processes it, the traversal writes attacker-controlled content outside the app's restricted directory and the app subsequently loads or executes it, yielding code execution in the app context. No public exploit is identified at time of analysis, and the low network complexity (AC:L) means that if a working technique is developed, delivery would be straightforward, though SSVC currently marks it as not automatable.