CVE-2026-65768: Microsoft Teams Remote Code Execution Vulnerability
CVE-2026-65768 is a remote code execution vulnerability in Microsoft Teams, rated Important by Microsoft, with a CVSS 3.1 base score of 8.8 (High). An attacker can exploit it remotely over the network, without any privileges and only if a user takes an action. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 0.94% probability of exploitation activity in the next 30 days, higher than 61% of all scored vulnerabilities. Microsoft released the fix on 11 August 2026 in the August 2026 Patch Tuesday. It affects 1 product in 1 product family (Microsoft Office).
Key facts
- CVE ID
- CVE-2026-65768
- Severity
- High CVSS 8.8
- Microsoft severity
- Important
- Impact
- Remote Code Execution
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- Less Likely
- Weakness
- CWE-22
- EPSS
- 0.94% (percentile 61%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- August 2026 Patch Tuesday
- Product families
- Microsoft Office
CVSS score and vector
Microsoft scores CVE-2026-65768 at 8.8 (temporal 7.7) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality impact | High |
| Integrity impact | High |
| Availability impact | High |
| Exploit code maturity | Unproven |
| Remediation level | Official fix |
| Report confidence | Confirmed |
Description
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Teams for Android allows an unauthorized attacker to execute code over a network.
Frequently asked questions (Microsoft)
According to the CVSS metric, the attack vector is network (AV:N) and user interaction is required (UI:R). What is the target context of the remote code execution?
This attack requires a user to open a specially crafted file from the attacker to initiate remote code execution.
Affected products (1)
Microsoft Office
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Microsoft Teams for Android | Release Notes | Security Update | 1.0.0.2026133602 | No |
NIST NVD data
- NVD status
- Analyzed
- NVD CVSS
- 8.8 (HIGH)
- NVD weakness
- CWE-22
- Published to NVD
- NVD last modified
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| teams | before 1.0.0.2026133602 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65768 (Vendor Advisory)
Acknowledgments
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. | |
| 1.1 | Corrected build number for the security update. This in an informational change only. |