CVE-2026-65769 is a medium severity (CVSS 6.5) information disclosure flaw in Microsoft Teams Mobile. Microsoft's update guide titles it a Teams iOS issue and lists version 8.14.1 as the fixed release. Update the app from the App Store and check your mobile management reports.
What's affected
The record describes exposure of sensitive information to an unauthorized actor (CWE-200) in Microsoft Teams Mobile, allowing an unauthorized attacker to disclose information over a network.
There is a small source difference. The record names the product as Teams Mobile. Microsoft's update guide titles the entry "Microsoft Teams iOS Information Disclosure Vulnerability" and lists the product as Microsoft Teams for iOS, with fixed version 8.14.1. I found no fixed build for Android in the update guide entry, so read it before assuming Android is or is not in scope.
Microsoft scores it 6.5 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, which matches the record. The user interaction is required, and no privileges are needed.
How to check if you're exposed
Read the Teams version on iOS devices. In the app's settings or in the App Store listing you can see the installed version, and a mobile management tool can report app versions across managed devices. Anything older than 8.14.1 on iOS is behind the fix.
Microsoft's FAQ says the information that could be disclosed is personally identifiable information. That tells you the likely data at stake: names, contact details and similar profile data. It does not describe message contents, and I will not claim that it does.
What to do now
- List Teams for iOS versions in your mobile management tool.
- Update to 8.14.1 or later from the App Store.
- Require a minimum app version where your conditional access setup allows it.
- Read the update guide entry to see whether Microsoft has added an Android build.
- If you handle regulated personal data in Teams, note the update date in your records.
Why it matters
Exposure of sensitive information happens when software hands data to a party that should not have it. The attacker here needs no account, only a way to get a user to take some action, which the vector calls required user interaction.
The score is moderate because the vector rates only confidentiality, with no integrity or availability impact. For organizations that hold personal data of staff or customers, even a confidentiality only flaw matters, because privacy duties apply to PII regardless of the CVSS number.
Microsoft marks it as not publicly disclosed and not exploited at release. The record's KEV flag is false. Microsoft rates it "Exploitation Less Likely".
Quick check
Which platform is affected?
Microsoft's entry is titled Teams iOS, and the record says Teams Mobile. Update iOS to 8.14.1 and read the entry to check Android.
What data could leak?
Microsoft says personally identifiable information. It gives no further detail.
Sources
- Microsoft Security Response Center update guide entry for CVE-2026-65769
- NVD record for CVE-2026-65769
Last reviewed: 18 October 2026.
