Microsoft Teams for Android: Cross-site scripting enabling spoofing
Summary
A cross-site scripting weakness (CWE-79) in Microsoft Teams for Android allows an unauthenticated remote attacker to perform spoofing over the network. The CNA rates the flaw as CVSS 3.1 7.5 (High), with no privileges and no user interaction required according to the vector. The exact preconditions for exploitation are not described in the sources available to us.
Affected
- Microsoft Teams for Android, versions 1.0.0 up to but not including 1416/1.0.0.2026202302
- The NVD description names only "Microsoft Teams". Whether Windows, macOS, web or iOS clients are affected is unconfirmed.
Fixed in
- Microsoft Teams for Android, build 1416/1.0.0.2026202302 or later
- Release date of the fixed build: Unknown.
Workaround
Unknown. No vendor workaround was found in the sources available to us.
Exploitation
- No public exploit is known (VulDB).
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact partial.
- Not listed in CISA KEV (Strix).
- No report of in-the-wild exploitation was found.
Our recommendation
- Update Teams for Android to build 1416/1.0.0.2026202302 or later on all managed devices, including BYOD phones.
- Enforce the minimum app version through MDM.
- Check the MSRC advisory for the full product list and exploitation preconditions.
- Treat this as a patch-priority item, even though no exploitation is known.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide: CVE-2026-116926 msrc.microsoft.com
- CVE.org record CVE-2026-116926 www.cve.org
- VulDB entry 434058 vuldb.com
- Strix CVE-2026-116926 www.strix.ai
- Wikipedia: Microsoft Teams en.wikipedia.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:45.
Original description (NVD)
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.