CVE-2026-32185: Microsoft Teams Spoofing Vulnerability

CVE-2026-32185 is a spoofing vulnerability in Microsoft Teams, rated Important by Microsoft, with a CVSS 3.1 base score of 5.5 (Medium). An attacker can exploit it by an attacker with local access, without any privileges and only if a user takes an action. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 0.47% probability of exploitation activity in the next 30 days, higher than 41% of all scored vulnerabilities. Microsoft released the fix on 12 May 2026 in the May 2026 Patch Tuesday. It affects 1 product in 1 product family (Microsoft Office).

Key facts

CVE ID: CVE-2026-32185
Severity: Medium CVSS 5.5
Microsoft severity: Important
Impact: Spoofing
Exploited in the wild: No
Publicly disclosed: No
Exploitation likelihood: Less Likely
Weakness: CWE-552
EPSS: 0.47% (percentile 41%)
CISA KEV: Not listed
Released: 12 May 2026
Last updated: 21 May 2026
Patch Tuesday: May 2026 Patch Tuesday
Product families: Microsoft Office

CVSS score and vector

Microsoft scores CVE-2026-32185 at 5.5 (temporal 4.8) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C

Metric	Value
Attack vector	Local
Attack complexity	Low
Privileges required	None
User interaction	Required
Scope	Unchanged
Confidentiality impact	High
Integrity impact	None
Availability impact	None
Exploit code maturity	Unproven
Remediation level	Official fix
Report confidence	Confirmed

Description

Files or directories accessible to external parties in Microsoft Teams allows an unauthorized attacker to perform spoofing locally.

Frequently asked questions (Microsoft)

Are the updates for Microsoft Teams for Android currently available?

Yes. As of May 21, 2026, the security update for Microsoft Teams for Android is available. Customers running Microsoft Teams for Android should ensure the update is installed to be protected from this vulnerability.

Affected products (1)

Microsoft Office

Product	Security update	Type	Fixed build	Restart
Microsoft Teams for Android	Release Notes	Security Update	1.0.0.2026092402	Maybe

NIST NVD data

NVD status: Analyzed
NVD CVSS: 5.5 (MEDIUM)
NVD weakness: CWE-552
Published to NVD: 12 May 2026
NVD last modified: 18 May 2026

Affected configurations (CPE)

Product	Vulnerable versions
teams	before 1.0.0.2026092103

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32185 (Vendor Advisory)

Acknowledgments

Ofek Levin Enclave with Enclave

Revision history

Version	Date	Description
1.0	12 May 2026	Information published.
2.0	18 May 2026	The security update for Microsoft Teams for Android is not immediately available. Customers running affected Microsoft Teams for would need to install the update to be protected from this vulnerability, once the update becomes available.
3.0	21 May 2026	Microsoft is announcing the availability of the security update for Microsoft Teams for Android. Customers running affected Microsoft Teams for Android should install the update for their product to be protected from this vulnerability.