CVE-2026-65767

Analyzed Analyzed - Analysis Complete

Microsoft Teams for Android Cross-Site Scripting Vulnerability

Publication date: 2026-08-11

Last updated on: 2026-08-16

Assigner: Microsoft Corporation

Description

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Teams for Android allows an authorized attacker to perform spoofing over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-16

Generated

2026-09-01

AI Q&A

2026-08-11

EPSS Evaluated

2026-08-30

NVD

CVE-2026-65767

EUVD

EUVD-2026-56774

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	teams	to 1.0.76.202611302 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a cross-site scripting (XSS) vulnerability in Microsoft Teams for Android. It occurs when user input is not properly neutralized during web page generation, allowing an attacker to inject malicious scripts. An authorized attacker can exploit this to perform spoofing attacks over a network.

Detection Guidance

This vulnerability is specific to Microsoft Teams for Android and involves cross-site scripting leading to spoofing. Detection typically requires checking for unusual network traffic or suspicious activity in Teams app logs. No direct commands are provided in the available resources.

Impact Analysis

An attacker could trick users into revealing sensitive information or performing unintended actions by spoofing legitimate content. This may lead to unauthorized access, data theft, or session hijacking if exploited successfully.

Compliance Impact

This vulnerability allows spoofing via cross-site scripting in Microsoft Teams for Android, which could lead to unauthorized data access or manipulation. Such risks may impact compliance with GDPR (data protection) and HIPAA (healthcare data privacy) by exposing sensitive information or enabling unauthorized actions.

Mitigation Strategies

Update Microsoft Teams for Android to the latest version to patch the vulnerability. Monitor network traffic for unusual activity and ensure input validation is enforced in web applications.

Hi! I’m here to help you understand CVE-2026-65767. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70