Microsoft Teams CVE-2026-65769

Based on the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation requires no authentication, no user interaction, and no special configuration - only network access to a device running Microsoft Teams for iOS in the affected version range (2.0.0 to before 8.8.1). Exploitation is strictly limited to the iOS (iPhone OS) platform; no other Teams client platforms are identified as affected by this CVE. The SSVC 'not automatable' designation introduces an important caveat: despite low CVSS complexity, the attack likely requires deliberate network positioning (e.g., man-in-the-middle, same-network proximity, or targeted traffic interception) rather than fully automated scanning, which limits blast radius in practice. Exploitation is further bounded by the relatively narrow version window of an actively-maintained mobile app that receives frequent updates.

At face value, the CVSS 7.5 High score with AV:N/AC:L/PR:N/UI:N/C:H presents an alarming profile: unauthenticated, low-complexity remote access to high-confidentiality data. However, cross-referencing additional signals significantly tempers urgency. EPSS at 0.68% (49th percentile) reflects no measurable exploitation uptake in the wild. SSVC rates exploitation as none, technical impact as only partial, and - critically - marks the vulnerability as not automatable, which is in mild tension with the CVSS AC:L (low complexity) rating; this discrepancy suggests that while no special configuration is required, the attack may require deliberate targeting or specific network positioning that precludes mass automated scanning. KEV status is absent, and no POC has been identified. Practically, this is a real vulnerability in a widely deployed platform warranting prompt patching, but it does not represent an emergency incident-response trigger. The absence of automatable exploitation and low EPSS score suggest targeted, opportunistic scenarios rather than widespread active campaigns.

An attacker with network access - for example, on the same Wi-Fi segment or in a position to intercept mobile traffic - sends crafted network requests to or monitors traffic from a vulnerable Microsoft Teams iOS client (versions 2.0.0 to before 8.8.1), causing the application to disclose sensitive information such as authentication tokens, message content, or user metadata. No public exploit code has been identified at time of analysis, and SSVC's not-automatable rating suggests active targeting rather than opportunistic mass exploitation is the more plausible threat model.