CVE-2026-65767 is a high severity (CVSS 8.8) cross-site scripting flaw in Microsoft Teams for Android that allows spoofing over a network. Microsoft lists build 1.0.0.2026142702 as the fixed release. Update the Android app through Google Play, or push it through your mobile device management tool.
What's affected
The record describes improper neutralization of input during web page generation, known as cross-site scripting (CWE-79), in Microsoft Teams for Android. It says an authorized attacker can perform spoofing over a network.
Microsoft's update guide lists Microsoft Teams for Android with a fixed build of 1.0.0.2026142702. The update guide scores it 8.8 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, which matches the record. Microsoft marks "Customer Action Required" as yes.
Microsoft also rates the issue "Exploitation Less Likely". It says the issue was not publicly disclosed and not exploited when it was released, and the record's KEV flag is false.
How to check if you're exposed
Teams for Android is a user installed app, so exposure depends on whether devices have the fixed build. Open the app's information page on a device and read the version. In a managed fleet, use your mobile device management tool to report installed app versions and look for builds older than 1.0.0.2026142702.
Microsoft's version string is long and includes the build date. Compare it carefully with the number above, and do not rely on the marketing name of the release.
Unmanaged phones are the hard part. If staff use personal devices for Teams, you may need a policy that requires a current app version before the device can reach corporate data, which conditional access can enforce in many setups.
What to do now
- Pull the Teams for Android version from your mobile management tool.
- Update to build 1.0.0.2026142702 or later from Google Play.
- Where possible, require a minimum app version before devices can access corporate Teams data.
- Tell users that Teams messages from unexpected senders can still be misleading, and ask them to report odd content.
- Check the Microsoft update guide entry for any later revision.
Why it matters
Cross-site scripting happens when an app places untrusted text into a page without handling it correctly, so the text is run as script. In a chat product, the attacker is another user or another tenant's content. Microsoft's own explanation says successful exploitation allows an attacker to impersonate another user and access information based on the victim's permissions.
That is why a spoofing label can still carry high impact. The vector rates confidentiality, integrity and availability all as high, and it needs no user interaction, only a low privilege account. Trust inside a collaboration app is the asset here, and this class of flaw undermines it.
Microsoft marks it as not publicly disclosed and not exploited at release. The record's KEV flag is false.
Quick check
Is a Teams update enough, or is there a server side fix?
Microsoft lists a client build as the fix, 1.0.0.2026142702, and marks customer action required. Update the app.
Does it need the victim to click anything?
The vector sets user interaction to none. Treat any exposed device as at risk until it is updated.
Sources
- Microsoft Security Response Center update guide entry for CVE-2026-65767
- NVD record for CVE-2026-65767
Last reviewed: 18 October 2026.
