Loading vulnerability…
Microsoft Teams for Android Spoofing Vulnerability
CVE-2026-32185 is an Important spoofing vulnerability affecting Microsoft Teams for Android. The issue is classified as CWE-552, indicating that files or directories are accessible to external parties. Microsoft states that this condition allows an unauthorized attacker to perform spoofing locally. The vulnerability appears to arise from improper exposure of Teams-accessible files or directories on the device, enabling manipulation or impersonation of trusted elements within the application. Microsoft assigned CVSS v3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N and a base score of 5.5.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a local, unauthorized attacker to spoof trusted content or elements within Microsoft Teams for Android. The primary security consequence is confidentiality impact, which Microsoft rated as High, indicating that the flaw could be used to mislead users into exposing sensitive information or trusting attacker-controlled content presented as legitimate. Microsoft did not indicate integrity or availability impact.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by restricting use of unpatched Microsoft Teams for Android on sensitive or regulated mobile endpoints until the official update can be installed. Prioritize patch deployment on devices used to access sensitive communications or data. No separate vendor workaround was identified beyond applying the official fix.
Patch, then assume compromise.
Apply the official Microsoft security update for Microsoft Teams for Android. Microsoft stated that the security update became available on May 21, 2026, and affected installations should be updated through the Google Play Store to build 1.0.0.2026092103 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.