# CVE-2026-65768: Microsoft Teams for Android path traversal remote code execution

Source: https://junglewise.ai/threats/cve-2026-65768-microsoft-teams-for-android-path-traversal-remote-code-execution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-65768 · Severity: high · CVSS 8.8 · Published 2026-08-11

Microsoft Teams for Android is a communication application used by millions of organizations for messaging and collaboration. A path traversal vulnerability in the application could allow an attacker to execute arbitrary code remotely, potentially compromising user devices, stealing sensitive communications, or disrupting business operations.

Technologies: [Microsoft Teams](https://junglewise.ai/threats/technologies/teams), [Microsoft Teams for Android](https://junglewise.ai/threats/technologies/teams-for-android). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2026-65768 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65768 being exploited in the wild.

**How severe is CVE-2026-65768?** High severity, with a CVSS score of 8.8, published 11 August 2026.

**Which products and versions are affected?** Microsoft Teams for Android <UNKNOWN>.

**Is there a fix for CVE-2026-65768?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-65768 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-65768?** Check whether you run Microsoft Teams or Microsoft Teams for Android at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a path traversal flaw (CWE-22) in Microsoft Teams for Android that fails to properly restrict file paths accessed by the application. An attacker can exploit this over the network by crafting malicious input that traverses directory boundaries and writes executable code to attainable locations on the device, leading to arbitrary code execution. The attack vector is network-based and does not require user authentication or interaction. A patch is likely available from Microsoft, though specific version information is not detailed in the advisory.

## Affected products

- Microsoft Teams for Android <UNKNOWN>

## Timeline

- 2026-08-11: disclosed

## References

- [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65768](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65768)

## Related threats

- [Microsoft Teams for Android origin validation error](https://junglewise.ai/threats/cve-2026-69901-origin-validation-error-in-microsoft-teams-for-android-allows-an)
- [Microsoft Teams for Android code injection spoofing vulnerability](https://junglewise.ai/threats/cve-2026-122979-improper-control-of-generation-of-code-code-injection-in)
- [Microsoft Teams cross-site scripting in web page generation](https://junglewise.ai/threats/cve-2026-116926-improper-neutralization-of-input-during-web-page-generation)
- [Microsoft Teams for Android origin validation bypass](https://junglewise.ai/threats/cve-2026-69559-microsoft-teams-for-android-origin-validation-bypass)
- [Microsoft Teams for Android information disclosure in network communication](https://junglewise.ai/threats/cve-2026-65812-microsoft-teams-for-android-information-disclosure-in-network)