External risk intelligence

Microsoft Teams for Android Path Traversal Vulnerability Allows Network Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-65768

This vulnerability affects a client-side mobile application (Microsoft Teams for Android). Such software is typically installed on end-user devices and does not function as an internet-facing service, gateway, or edge server, making public-internet-facing exposure in a server-side context very unlikely.

Path Traversal

Microsoft Teams

before 1.0.0.2026133602

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Microsoft Teams for Android, potentially allowing unauthorized remote attackers to execute code. This issue stems from an improper limitation in how the application handles file paths, which could lead to unintended access and execution. The main concern is confirming if this specific application and version are in use within the organization and if any exposure exists.

Path traversal flaw in Teams for Android.
Critical remote code execution risk.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit a flaw in Microsoft Teams for Android by sending a specially crafted network request. This could allow them to execute code remotely, potentially leading to significant compromise of the affected device and its data.

Network access is required.
A specially crafted network request triggers the vulnerability.
Remote code execution poses a high risk.

Live Threat

Current exploitation, exposure, and threat context

An attacker could execute code over a network by exploiting a path traversal vulnerability in Microsoft Teams for Android. This could affect the integrity and availability of the application and potentially the device it is installed on, under conditions where the app's handling of specific inputs is not properly restricted.

User's Teams application data.
Through crafted network requests to the app.
Unauthorized code execution on device.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Microsoft Teams for Android requires immediate attention from teams managing mobile device fleets and the application itself. The first practical move is to identify all Android devices running Teams, confirm their network reachability and business criticality, and then identify the accountable owner for remediation.

Mobile device and application owners.
Verify Android Teams device exposure.
Plan targeted remediation and user communication.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Microsoft Teams for Android?

Microsoft Teams for Android is the mobile application version of the Microsoft Teams collaboration platform, designed to run on devices using the Android operating system. It allows users to participate in chats, video meetings, and file sharing while on the go. This software acts as a client-side application, typically managed by end-users or mobile device management systems rather than functioning as a server.

What does path traversal mean for CVE-2026-65768?

Path traversal, identified here as CWE-22, is a weakness where an application fails to properly sanitize user input used to access files. By manipulating file paths, an attacker can trick the software into accessing or executing files outside of its intended, secure directory. In this specific vulnerability, this flaw allows an unauthorized party to execute arbitrary code on the affected Android device.

How is this vulnerability triggered?

The vulnerability is triggered when the Teams application processes a specially crafted network request containing malicious input. Importantly, standard, legitimate use of the application—such as normal messaging or meeting participation—does not trigger this flaw. The attack requires the delivery of specific, malicious data packets designed to exploit the application's path handling logic.

Is my organization at risk from this CVE?

According to Halo Surface Signal, this vulnerability is classified as 'very unlikely' to have public internet-facing exposure. Because the affected software is a client-side mobile app installed on individual devices, it does not act as a traditional internet-facing server or gateway. The primary concern is whether your organization has Android devices running an outdated version of the Teams application.

How should I respond to this threat?

Start by identifying all Android devices in your fleet that have Microsoft Teams installed. Verify the version number on these devices to see if they are running a version earlier than 1.0.0.2026133602. If vulnerable versions are found, prioritize updating the application through the official app store or your mobile device management console to ensure the software's path handling protections are correctly applied.

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65768

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.