Microsoft Teams For Android
Monthly
CVE-2026-26133 is an AI command injection vulnerability in Microsoft 365 Copilot and multiple Microsoft mobile/desktop applications that allows remote attackers to disclose sensitive information through crafted AI prompts. The vulnerability affects numerous Microsoft products across iOS, Android, and macOS platforms, requires user interaction, and has a patch available from Microsoft with no current evidence of active exploitation (not in KEV).
Microsoft Teams for Android exposes internal files or directories to unauthorized local parties via CWE-552 (Files or Directories Accessible to External Parties), enabling a local attacker to perform identity spoofing. Affected versions span all releases of Teams for Android below 1.0.0.2026092103. No public exploit code has been identified and CISA has not added this to the Known Exploited Vulnerabilities catalog, though the SSVC framework rates the technical impact as total, suggesting that successfully accessed data could fully compromise the Teams session or identity context on the device.
CVE-2026-26133 is an AI command injection vulnerability in Microsoft 365 Copilot and multiple Microsoft mobile/desktop applications that allows remote attackers to disclose sensitive information through crafted AI prompts. The vulnerability affects numerous Microsoft products across iOS, Android, and macOS platforms, requires user interaction, and has a patch available from Microsoft with no current evidence of active exploitation (not in KEV).
Microsoft Teams for Android exposes internal files or directories to unauthorized local parties via CWE-552 (Files or Directories Accessible to External Parties), enabling a local attacker to perform identity spoofing. Affected versions span all releases of Teams for Android below 1.0.0.2026092103. No public exploit code has been identified and CISA has not added this to the Known Exploited Vulnerabilities catalog, though the SSVC framework rates the technical impact as total, suggesting that successfully accessed data could fully compromise the Teams session or identity context on the device.