Microsoft Teams for Android Vulnerability Allows Attackers to Disclose Sensitive Data

HomeCyber Security Microsoft Teams for Android Vulnerability Allows Attackers to Disclose Sensitive Data By Guru Baran June 12, 2026 Microsoft has disclosed a significant security vulnerability in Microsoft Teams for Android that could allow an authenticated attacker to expose sensitive information over a network. The flaw, tracked as CVE-2026-42835, was officially released on June 9, 2026, and has been rated Important in severity. The vulnerability stems from improper neutralization of special elements in output used by a downstream component, classified under CWE-74 (Injection). According to Microsoft’s advisory, the weakness enables an authorized attacker to disclose information remotely, without requiring any user interaction. The flaw carries a CVSS 3.1 base score of 8.1 (temporal score: 7.1), reflecting its considerable risk. The attack vector is Network (AV:N), confirming the vulnerability is remotely exploitable over the internet. With an attack complexity of Low (AC:L), an attacker does not need advanced knowledge of the target system and can achieve repeatable exploitation success with a crafted payload against the vulnerable component. Microsoft confirmed that a successful exploit could allow an attacker to read small portions of heap memory. While the scope of exposed data may appear limited, heap memory can contain sensitive runtime information, including authentication tokens, session data, or cached credentials, making even partial disclosure a serious concern in enterprise environments. The CVSS metrics indicate a high impact on both Confidentiality and Availability, with no integrity impact. The Privileges Required metric is rated Low, meaning any authenticated user, including low-privileged accounts, could potentially trigger the vulnerability. Microsoft’s exploitability assessment classifies this vulnerability as Exploitation Less Likely. The flaw has not been publicly disclosed and has not been observed in active exploitation at the time of publication. Exploit code maturity is listed as Unproven, and an official fix is already available. Microsoft has released a security update for Microsoft Teams for Android, available through the Google Play Store. Users and enterprise administrators are strongly advised to update the application immediately via the official Microsoft Teams listing on Google Play. Organizations relying on Teams for internal communications should prioritize this update, especially given the app’s widespread use in handling sensitive business conversations and file sharing. The vulnerability was responsibly disclosed by Ofek Levin of Enclave through Microsoft’s coordinated vulnerability disclosure program. Tags cyber security cyber security news Copy URL Linkedin Twitter ReddIt Telegram Guru Baranhttps://cybersecuritynews.com Gurubaran KS is a cybersecurity analyst, and Journalist with a strong focus on emerging threats and digital defense strategies. He is the Co-Founder and Editor-in-Chief of Cyber Security News, where he leads editorial coverage on global cybersecurity developments. Trending News Hackers Can Hijack Claude Code MCP Traffic to Steal OAuth Tokens Critical Langflow Vulnerability Exploited to Execute Malicious Code Agentic AI Red Teaming Reveals Zero-Click Human-in-the-Loop Bypass Attack Chains Fortinet FortiSandbox Vulnerability Allows Attackers to Execute Unauthorized Commands Critical Redis RCE Vulnerability Enable Attackers to Gain Complete Control to Host Server Latest News Cyber Security CISA Requires Federal Agencies to Patch Critical Vulnerabilities Within 3 Days Cyber Security News OceanLotus APT Compromises FireAnt MetaKit in Supply-Chain Attack on Stock Investors Cyber Security News GoFlateLoader Uses Massive PE Overlay to Deliver Lumma, Vidar, and StealC Infostealers Cyber Security News Critical Langflow Vulnerability Exploited to Execute Malicious Code Cyber Security News Hackers Abuse SniperDz PhaaS Ecosystem for Brand Impersonation and Browser Hijacking