EUVD-2026-56565
GHSA-7pf9-3pj8-5x2j
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-accessible iOS client exposes data to unauthenticated remote actors; no integrity or availability impact identified from description.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
Exposure of sensitive information to an unauthorized actor in Microsoft Teams Mobile allows an unauthorized attacker to disclose information over a network.
AnalysisAI
Sensitive information disclosure in Microsoft Teams for iOS (versions 2.0.0 through prior to 8.8.1) enables unauthenticated network attackers to access protected data without any user interaction, as reflected in the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N with C:H. The vulnerability is rooted in CWE-200 improper information exposure and is iOS-platform-specific, confirmed by CPE cpe:2.3:a:microsoft:teams:*:*:*:*:*:iphone_os:*:*. No active exploitation is confirmed - the CVE is absent from the CISA KEV catalog, SSVC assessment rates exploitation as none, and EPSS sits at 0.68% (49th percentile), indicating low observed exploitation probability at time of analysis.
Technical ContextAI
CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) describes a failure where a product inadvertently reveals data to actors lacking authorization to receive it - common causes include insecure transmission (missing TLS enforcement or certificate validation), improper caching of sensitive payloads in local storage or HTTP responses, or leakage through API responses that return more data than the requester's authorization scope permits. The affected product is Microsoft Teams for iOS, specifically the iPhone OS platform build, as confirmed by CPE cpe:2.3:a:microsoft:teams:*:*:*:*:*:iphone_os:*:*. EUVD EUVD-2026-56565 narrows the affected version window to 2.0.0 up to (but not including) 8.8.1, indicating a broad span of iOS client builds are exposed. The network attack vector (AV:N) and no-privilege-required (PR:N) metrics indicate the information is reachable without local device access or authenticated session context.
RemediationAI
Upgrade Microsoft Teams for iOS to version 8.8.1 or later, which contains the vendor-released patch as confirmed by the EUVD affected version range and the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65769. Users should apply the update via the Apple App Store. If immediate update is operationally constrained, consider enforcing conditional access policies that restrict Teams mobile sessions to compliant, managed devices and trusted networks, reducing exposure to opportunistic network-based interception. Organizations using Microsoft Intune or similar MDM platforms can deploy app version compliance policies to flag or block non-patched Teams iOS builds. Note that network-layer controls alone (e.g., firewall rules) are insufficient given the network-accessible nature of the flaw; the application-level patch is the only confirmed remediation.
Privilege elevation in Microsoft Teams lets a remote, unauthenticated attacker gain unauthorized access across a network
Path-traversal-driven remote code execution affects the Microsoft Teams client for Android in all builds prior to 1.0.0.
A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work
Privilege elevation in Microsoft Teams allows an authenticated attacker with low-level access to bypass authentication c
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to
Cross-site scripting in Microsoft Teams for Android (versions below 1.0.76.202611302) enables an authenticated attacker
Cryptographic signature spoofing in Microsoft Teams exposes enterprise collaboration environments to unauthenticated ide
The Microsoft Teams online service contains a stored cross-site scripting vulnerability in the displayName parameter tha
Microsoft Teams Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Teams Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today