Microsoft Teams vulnerabilities

31 CVEs affecting Microsoft Teams, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-69559, published 2026-09-08.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-4863: Google Chromium WebP Heap-Based Buffer Overflow Vulnerability, published 2023-09-12. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2023-09-13. EPSS: 100% chance of exploitation in the next 30 days. Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium…
• CVE-2024-38197, published 2024-08-13. Medium severity, CVSS 6.5. EPSS: 16.8% chance of exploitation in the next 30 days. Microsoft Teams for iOS Spoofing Vulnerability
• CVE-2019-5922, published 2019-03-12. High severity, CVSS 7.8. EPSS: 4.6% chance of exploitation in the next 30 days. Untrusted search path vulnerability in The installer of Microsoft Teams allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
• CVE-2021-24114, published 2021-02-25. Medium severity, CVSS 5.7. EPSS: 3.2% chance of exploitation in the next 30 days. Microsoft Teams iOS Information Disclosure Vulnerability
• CVE-2022-21965, published 2022-02-09. High severity, CVSS 7.5. EPSS: 3% chance of exploitation in the next 30 days. Microsoft Teams Denial of Service Vulnerability
• CVE-2020-10146, published 2020-12-09. Medium severity, CVSS 5.4. EPSS: 2.3% chance of exploitation in the next 30 days. The Microsoft Teams online service contains a stored cross-site scripting vulnerability in the displayName parameter that can be exploited on Teams clients to obtain sensitive information such as…
• CVE-2023-29328, published 2023-08-08. High severity, CVSS 8.8. EPSS: 2.2% chance of exploitation in the next 30 days. Microsoft Teams Remote Code Execution Vulnerability
• CVE-2023-29330, published 2023-08-08. High severity, CVSS 8.8. EPSS: 2% chance of exploitation in the next 30 days. Microsoft Teams Remote Code Execution Vulnerability
• CVE-2020-17091, published 2020-11-11. High severity, CVSS 7.8. EPSS: 1.9% chance of exploitation in the next 30 days. Microsoft Teams Remote Code Execution Vulnerability
• CVE-2023-24881, published 2023-07-11. Medium severity, CVSS 6.5. EPSS: 1.5% chance of exploitation in the next 30 days. Microsoft Teams Information Disclosure Vulnerability

Latest

• CVE-2026-69559, published 2026-09-08. Medium severity, CVSS 6.3. EPSS: 0.3% chance of exploitation in the next 30 days. Origin validation error in Microsoft Teams for Android allows an authorized attacker to disclose information over a network.
• CVE-2026-65812, published 2026-09-08. Medium severity, CVSS 6.8. EPSS: 0.9% chance of exploitation in the next 30 days. Insertion of sensitive information into sent data in Microsoft Teams for Android allows an authorized attacker to disclose information over a network.
• CVE-2026-65769, published 2026-08-11. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. Exposure of sensitive information to an unauthorized actor in Microsoft Teams Mobile allows an unauthorized attacker to disclose information over a network.
• CVE-2026-65768, published 2026-08-11. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Teams for Android allows an unauthorized attacker to execute code over a network.
• CVE-2026-65767, published 2026-08-11. High severity, CVSS 7.6. EPSS: 0.6% chance of exploitation in the next 30 days. Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Teams for Android allows an authorized attacker to perform spoofing over a network.
• CVE-2026-65667, published 2026-08-07. Critical severity, CVSS 10.0. EPSS: 0.8% chance of exploitation in the next 30 days. Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-62918, published 2026-08-07. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network.
• CVE-2026-62896, published 2026-08-07. Critical severity, CVSS 9.6. EPSS: 0.7% chance of exploitation in the next 30 days. Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over a network.
• CVE-2026-42835, published 2026-06-09. High severity, CVSS 8.1. EPSS: 1.2% chance of exploitation in the next 30 days. Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Teams for Android allows an authorized attacker to disclose information over a network.
• CVE-2026-32185, published 2026-05-12. Medium severity, CVSS 5.5. EPSS: 0.5% chance of exploitation in the next 30 days. Files or directories accessible to external parties in Microsoft Teams allows an unauthorized attacker to perform spoofing locally.