Microsoft Teams CVE-2026-65812

Exploitation requires: (1) the attacker holds or controls a low-privilege Microsoft Teams account (PR:L - unauthenticated exploitation is not supported by the CVSS vector); (2) a victim user performs a specific in-app action in Teams for Android (UI:R - the exact triggering action is not described in available data and must be inferred from the full MSRC advisory); (3) the attacker is network-positioned to intercept the outbound transmission, e.g., via a shared Wi-Fi network, corporate proxy, or local certificate pinning bypass. The vulnerability is specific to the Android mobile client - Teams for iOS, desktop, and web are not listed as affected. The scope change (S:C) implies the leaked information may pertain to other users or backend systems, amplifying post-interception impact beyond the attacker's own account.

The CVSS 3.1 score of 6.8 (Medium) is calibrated by the conflicting signals of broad network exploitability (AV:N/AC:L) against the authentication barrier (PR:L) and required user interaction (UI:R). Real-world risk is moderate: the attacker must hold a valid, low-privilege Teams account and must induce or observe a victim user performing a specific in-app action before the sensitive transmission is generated. The scope-changed high confidentiality impact (S:C/C:H) is the primary concern - if the intercepted data includes session tokens or credentials, secondary compromise of other accounts or services becomes realistic. The absence from CISA KEV and the lack of any public exploit code reduce immediate emergency priority; EPSS data was not provided in available intelligence. Enterprise environments with large mobile Teams deployments - whether a major financial institution or a mid-sized public-sector IT operation - should treat this as a standard patch-cycle priority rather than emergency response, though organizations with strict data-classification requirements (healthcare, legal, government) should accelerate mobile fleet patching given C:H.

An attacker with a valid low-privilege Teams account on Android, or positioned to monitor network traffic on a shared or compromised network segment, waits for a victim user to perform a specific in-app action in Microsoft Teams for Android. The action triggers the client to include sensitive data - such as an authentication token or private content - in an outbound network request that the attacker intercepts via a proxy, packet capture, or network tap. No public exploit code has been identified, but the low attack complexity (AC:L) suggests the triggering interaction is straightforward once the exact function is known from MSRC advisory detail.