CVE-2026-65768 is a high severity (CVSS 8.8) path traversal flaw in Microsoft Teams for Android. Microsoft's record says an unauthorized attacker could execute code over a network. The attack needs the user to take an action. Update the Teams app on Android devices and confirm the fixed build in Microsoft's advisory.
What's affected
- Product: Microsoft Teams for Android.
- Weakness: CWE-22 path traversal, described as improper limitation of a pathname to a restricted directory.
- Severity: CVSS 3.1 8.8, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. No privileges are needed, but user interaction is required. - Fixed version: not confirmed. The Microsoft page for this CVE needs JavaScript and did not load for me, so check it for the fixed build.
How to check if you're exposed
Teams for Android is updated through Google Play or through your mobile device management tool. To see the installed version on one device, open Android Settings, then Apps, then Teams, and read the version at the bottom.
For a fleet, use your MDM or mobile threat tool to list the Teams package version per device and compare it with the fixed build in Microsoft's advisory. Devices that are not managed, such as personal phones used for work, need a reminder to update.
What to do now
- Read the Microsoft advisory for CVE-2026-65768 and note the fixed Teams for Android build.
- List Android devices with Teams installed and their versions.
- Push the update through your MDM or ask users to update from Google Play.
- Remove or block devices that stay on old builds from corporate data.
- Tell users to be careful with unexpected files and links received in Teams until they update.
Why it matters
Path traversal means the app builds a file path from input that it does not fully check, so the path can step outside the folder it was meant to stay in. In a mobile chat app, that input can come from a message, a file name or a shared item.
The vector shows user interaction is required, so the attacker needs a person to open or accept something. That is realistic in a messaging app. Microsoft's record does not say the flaw is exploited, and the CISA KEV flag is false.
Quick check
Does the user have to do anything for an attack to work?
The vector says user interaction is required, so yes. That is why updating the app matters more than relying on user care alone.
Which build fixes it?
I could not read that from Microsoft's page. Check the advisory before you tell anyone a specific number.
Sources
- Microsoft Security Response Center entry (listed in the record; its page needs JavaScript, so I could not read build numbers from it)
- Gold record for CVE-2026-65768
Last reviewed: 19 October 2026.
