EUVD-2026-100782
GHSA-5352-6hwr-v79v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted link to target user
-
DeliveryUser opens link in TeamPlus Messenger
-
ExploitInjected JavaScript executes in client
-
ExecutionVictim confirms Windows security warning
-
ImpactArbitrary code runs as current user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim, using TeamPlus Messenger on Windows, to (1) open an attacker-crafted link that injects and runs arbitrary JavaScript in the client, and then (2) explicitly confirm a Windows security warning dialog before native code executes at the current user's privilege level. No authentication is required of the attacker (PR:N), but these two mandatory user actions (UI:A) are the principal limiting factors: a victim who ignores the link or declines the Windows warning is not compromised, and code execution is bounded to the privileges of the logged-in user, not SYSTEM/admin. |
| Impact | This is a genuine high-severity remote code execution issue (CVSS 4.0 base 8.6, High) but one whose real-world risk is meaningfully gated by user interaction. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) confirms a network-reachable, low-complexity, unauthenticated flaw with HIGH impact to confidentiality, integrity and availability (VC:H/VI:H/VA:H) and no subsequent-system scope change (SC/SI/SA:N). The decisive mitigating signal is UI:A (active user interaction): the description requires the victim to both open a crafted link AND click through a Windows security warning before arbitrary code runs with the current user's privileges - two deliberate social-engineering steps, not a drive-by. No EPSS probability score was supplied, there is no CISA KEV listing, and no public proof-of-concept was referenced, so exploitation status is: no public exploit identified at time of analysis. No SSVC decision data was provided. The signals are internally consistent (no CVSS-versus-description conflict), but the absence of EPSS/KEV/POC combined with the mandatory double user interaction argues this is a prioritize-but-not-emergency issue rather than a mass-exploitation threat. Note: only a CVSS 4.0 vector was provided - no CVSS 3.1 vector or numeric EPSS was in the input, so exploitation likelihood cannot be quantified. |
| Exploit ScenarioDerived | An attacker sends a victim a crafted link (via chat, email, or a malicious message inside TeamPlus Messenger). When the victim opens it, attacker-controlled JavaScript is injected and executed within the client; if the victim then confirms the Windows security warning dialog, arbitrary code executes with that user's privileges. No public exploit code was referenced, and success depends on the victim completing both interaction steps, consistent with the AC:L but UI:A rating. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Remote code execution in TeamPlus Messenger for Windows lets an unauthenticated attacker deliver a crafted link that injects and executes arbitrary JavaScript inside the client, escalating to native code execution with the privileges of the logged-in user once the victim opens the link and confirms a Windows security warning dialog. Rated CVSS 4.0 base 8.6 (High) and mapped to CWE-94, the flaw's practical severity is gated by two mandatory victim actions - following the malicious link and accepting the Windows prompt - so only users who both act are compromised, and execution is confined to user-level privileges rather than SYSTEM or administrative rights. At the time of analysis no public exploit code was identified and the issue was not listed in CISA KEV; only TWCERT/CC advisory references are available, and no vendor patched version is specified in the provided data.
RemediationAI
No vendor-released patch or fixed version is identified in the provided data, so the first action is to confirm remediation status directly with Teamplus Technology and with TWCERT/CC via the published advisories at https://www.twcert.org.tw/en/cp-139-11271-be75e-2.html and https://www.twcert.org.tw/tw/cp-132-11270-88d86-1.html, then upgrade to the vendor-designated fixed build as soon as it is published. Until a fix is available, compensating controls should target the two gating conditions of the attack: reduce exposure to malicious links (disable or restrict automatic link opening and in-app link previews, and block untrusted domains at the messaging gateway or via URL filtering - this may break legitimate link navigation and should be piloted before broad rollout), and harden the Windows prompt/execution path (enforce application allowlisting and Script Blocking/Attack Surface Reduction rules that prevent unapproved script or executable launches from the messenger process, accepting that this can generate false positives and block legitimate plugin functionality). Additionally, train users to treat unexpected links in TeamPlus Messenger as hostile and to decline any Windows security warning triggered by the client, and remove local administrative rights from day-to-day accounts so that any successful code execution remains limited to standard user privileges. Monitor endpoint telemetry for child processes spawned by TeamPlus Messenger and for unexpected script execution originating from the client, and restrict or disable the URI/protocol handler that enables link-triggered execution if the vendor provides guidance for doing so, noting that this degrades normal link workflows. If the vendor ultimately confirms the product is end-of-life or will not be patched, treat migration to a supported messenger as the only durable mitigation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-94 (Improper Control of Generation of Code / Code Injection): the TeamPlus Messenger Windows client fails to properly neutralize attacker-supplied input before it is interpreted as executable content, allowing JavaScript injected through a crafted link to run within the client's rendering/scripting context. This script-level foothold is then leveraged to invoke native code execution on the host, which is why the vendor classification carries the RCE and Microsoft tags alongside Code Injection. The attack chain depends on the client's link-handling behavior and its interaction with the Windows security warning subsystem: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) confirms a network-reachable, low-complexity, unauthenticated attack path whose sole precondition is active user participation. Scope is unchanged (S:U), and subsequent-system metrics are all None (SC:N/SI:N/SA:N), meaning the impact is bounded to the single vulnerable component and the running user's privileges rather than spreading to other security authorities. No CPE identifiers were supplied, so the exact affected build/version of TeamPlus Messenger could not be independently pinned from the available data.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-delivered crafted link, no attacker auth (PR:N), but victim must open the link and confirm a Windows prompt so UI:R; code runs as current user with full C/I/A impact and no scope change.
Primary rating from Vendor (cert).
CVSS VectorVendor: cert
DescriptionCVE.org
TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into opening a crafted link to inject and execute arbitrary JavaScript. After the user confirms a Windows security warning, attackers can execute arbitrary code with the privileges of the current user.
Executive ViewAI
TeamPlus Messenger for Windows contains a high-severity remote code execution vulnerability (CVE-2026-110444) that allows an attacker to compromise user accounts through a crafted link. No vendor patch is currently available, and no public exploit identified at time of analysis, yet the organizational risk is elevated for teams relying on this application. Leadership should prioritize mitigating exposure because a successful attack can lead to unauthorized access to user data and systems, potentially resulting in data loss or further compromise within the network.
No vendor-released patch identified at time of analysis; interim mitigations include user education to avoid clicking links and accepting unexpected prompts, restricting application use to essential personnel, implementing network monitoring for indicators of compromise, and enforcing least privilege to limit the impact of user-level code execution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB