CVE-2026-65812: Microsoft Teams Android Data Leak Flaw

CVE-2026-65812 Overview

CVE-2026-65812 is an information disclosure vulnerability in Microsoft Teams for Android. The flaw stems from insertion of sensitive information into sent data [CWE-201], allowing an authenticated attacker to disclose information over a network. Exploitation requires low privileges and user interaction, but the scope is changed, meaning the impact extends beyond the vulnerable component. Microsoft published the advisory on September 8, 2026.

Critical Impact
An authorized attacker can obtain sensitive data transmitted by the Microsoft Teams Android client, potentially exposing confidential communications or metadata across trust boundaries.

Affected Products

Microsoft Teams for Android

Discovery Timeline

2026-09-08 - CVE-2026-65812 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-65812

Vulnerability Analysis

The vulnerability is classified under [CWE-201]: Insertion of Sensitive Information Into Sent Data. Microsoft Teams for Android transmits data that unintentionally includes sensitive content the recipient or observer should not receive. An authorized user of the application can leverage this behavior to disclose information over a network to unintended parties.

The issue affects confidentiality only. Integrity and availability of the Teams service are not impacted. Because the CVSS scope is changed, disclosed data may cross security boundaries, exposing information belonging to accounts or tenants other than the attacker's own. User interaction is required, indicating the disclosure path is triggered through a normal client workflow rather than an unauthenticated remote request.

Root Cause

The root cause is improper filtering of outbound data within the Android Teams client. Sensitive fields, tokens, or contextual metadata are attached to messages, requests, or telemetry that traverse the network. The application does not strip or scope this data before transmission, resulting in exposure to observers or recipients who are not authorized to view it.

Attack Vector

Exploitation occurs over the network by an authenticated Teams user who initiates an in-app action that triggers the data-sending path. The attacker then observes or receives the transmitted payload containing sensitive information. No elevated privileges are required beyond a valid Teams account with low privileges on the target tenant.

No public proof-of-concept, exploit code, or vendor patch details beyond the Microsoft Security Update Guide entry are available at the time of publication. See the Microsoft Security Update Guide for CVE-2026-65812 for authoritative technical detail.

Detection Methods for CVE-2026-65812

Indicators of Compromise

Unexpected outbound requests from the Microsoft Teams Android client containing session identifiers, authentication artifacts, or tenant metadata in unusual fields.
Teams client versions older than the fixed build referenced in the Microsoft advisory running on managed Android devices.
Anomalous message payload sizes or duplicated data transmission from Teams on Android endpoints.

Detection Strategies

Inventory Android devices running Microsoft Teams and correlate installed versions with the Microsoft advisory's fixed build.
Inspect mobile network telemetry for Teams traffic that includes structured metadata or sensitive fields outside expected schemas.
Review mobile threat defense (MTD) alerts for information disclosure signatures affecting Microsoft Teams on Android.

Monitoring Recommendations

Enable mobile application inventory reporting through your Mobile Device Management (MDM) or Unified Endpoint Management (UEM) platform.
Monitor Microsoft 365 audit logs for unusual data access patterns originating from Teams mobile sessions.
Track Microsoft Security Response Center (MSRC) advisory updates for revised affected version ranges.

How to Mitigate CVE-2026-65812

Immediate Actions Required

Update Microsoft Teams for Android to the latest version available in Google Play on all managed and BYOD devices.
Enforce a minimum Teams application version through MDM conditional access policies.
Restrict Teams access from unmanaged Android devices until the client update is confirmed.

Patch Information

Microsoft addressed CVE-2026-65812 in an updated release of Microsoft Teams for Android. Consult the Microsoft Security Update Guide for CVE-2026-65812 for the exact fixed version and deployment guidance.

Workarounds

Apply conditional access policies requiring compliant, up-to-date Teams client versions before permitting authentication.
Educate users to avoid sharing highly sensitive content through Teams mobile until patched versions are deployed across the estate.
Where feasible, direct users to the Teams desktop or web client until the Android update is verified in production.

bash

# Example: enforce a minimum Teams for Android version via Microsoft Intune app protection policy
# Set the minimum app version requirement referenced in the MSRC advisory
Set-IntuneAppProtectionPolicy \
  -DisplayName "Teams Android - CVE-2026-65812" \
  -MinAppVersion "<fixed-version-from-msrc>" \
  -AppActionIfMinAppVersion "block"