Microsoft Teams for Android: Code injection leading to spoofing
Summary
Microsoft Teams for Android contains a code injection weakness (CWE-94) that Microsoft describes as a spoofing vulnerability. An unauthorized remote attacker can exploit it over the network, and the CVSS vector indicates high impact on confidentiality and integrity. The attack requires user interaction, and the exact preconditions and attacker capabilities are not described in the sources.
Affected
- Microsoft Teams for Android, versions from 1.0.0 before 1416/1.0.0.2026173602
Fixed in
- Microsoft Teams for Android, build 1416/1.0.0.2026173602 or later (per CNA record; verify on MSRC)
Workaround
- Unknown. No workaround is documented in the sources. Apply the update.
Exploitation
- No evidence of exploitation in the wild found.
- CISA KEV: not listed.
- No public proof of concept found.
- CVSS exploit maturity: E:U (unproven).
- NVD status at publication: Awaiting Analysis.
Our recommendation
- Inventory Android devices with Microsoft Teams and identify builds below 1416/1.0.0.2026173602.
- Update Microsoft Teams via Google Play or MDM and verify compliance.
- Enforce the update policy on managed devices (MDM/Intune).
- Re-check the MSRC advisory and NVD analysis, and monitor the KEV status.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-122979 www.cve.org
- Microsoft Security Update Guide msrc.microsoft.com
- Strix CVE-2026-122979 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 01:35.
Original description (NVD)
Improper control of generation of code ('code injection') in Microsoft Teams for Android allows an unauthorized attacker to perform spoofing over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.