CVE-2026-110444

Deferred Deferred - Pending Action

Code Injection in TeamPlus Messenger

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: TWCERT/CC

Description

TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into opening a crafted link to inject and execute arbitrary JavaScript. After the user confirms a Windows security warning, attackers can execute arbitrary code with the privileges of the current user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110444

EUVD

EUVD-2026-100782

Affected Vendors & Products

Vendor	Product	Version / Range
TEAMPLUS	TECHNOLOGY	TeamPlus Messenger 16.8.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

TeamPlus Messenger has a code injection vulnerability where unauthenticated remote attackers can trick users into opening a crafted link to inject and execute arbitrary JavaScript. If the user confirms a Windows security warning, attackers can execute arbitrary code with the current user's privileges.

Detection Guidance

Detecting this vulnerability requires checking the installed version of TeamPlus Messenger. Compare the version against v16.8.0 to v17.0.6. If the version falls within this range, the system is vulnerable. No specific commands are provided in the resources, but version checks can be done via system settings or application properties.

Impact Analysis

This vulnerability allows attackers to execute arbitrary code on your system with your current user privileges. This could lead to data theft, installation of malware, or unauthorized system access if you interact with a malicious link.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially exposing sensitive user data. For GDPR, it may result in data breaches requiring notification under Article 33. For HIPAA, it could compromise protected health information if exploited in healthcare environments.

Mitigation Strategies

Immediately upgrade TeamPlus Messenger to version 17.0.7 or later. This is the only confirmed mitigation step provided in the resources. Ensure all users are notified to avoid opening untrusted links until the update is applied.

Hi! I’m here to help you understand CVE-2026-110444. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70