Critical Microsoft Teams Vulnerability Lets Attackers Spoof URLs

Key Takeaways

• A critical vulnerability, CVE-2026-32185, has been identified in Microsoft Teams for Android.
• The flaw allows local attackers to spoof trusted elements within the application, deceiving users into interacting with malicious content.
• The vulnerability carries a CVSS 3.1 base score of 5.5 and has been rated “Important” by Microsoft.
• A security update is available via the Google Play Store, and users are urged to update immediately.

Critical Spoofing Vulnerability Discovered in Microsoft Teams for Android

A significant security vulnerability has been uncovered in Microsoft Teams for Android, posing a risk of device spoofing by malicious actors. This flaw raises considerable concerns for both large organizations and individual users who depend on the communication platform daily.

Details of the Vulnerability

Microsoft officially disclosed CVE-2026-32185 on May 12, 2026, as part of its scheduled May 2026 Patch Tuesday security update cycle. The vulnerability exposes a critical weakness in how Microsoft Teams manages access to files and directories, potentially enabling an attacker to manipulate or impersonate trusted components within the application.

At its core, the flaw originates from the fact that certain files or directories within Microsoft Teams are accessible to external entities. This misconfiguration allows an unauthorized local attacker to execute spoofing attacks, tricking users into believing malicious content or communications are legitimate.

While the exploit requires some user interaction and is confined to a local attack vector, its potential impact on data confidentiality is rated as High. This makes it a serious concern, especially for environments handling sensitive enterprise data.

Severity and Exploitation Assessment

The vulnerability has been assigned a CVSS 3.1 base score of 5.5, with an adjusted environmental score of 4.8. Microsoft has categorized its severity as “Important.” Notably, exploiting this vulnerability does not require any special privileges, lowering the barrier for an attacker operating in a shared or already compromised local environment.

As of the disclosure date, there have been no public reports or active exploitation of this vulnerability in the wild. Microsoft’s own assessment categorizes its exploitability as “Exploitation Less Likely,” and no public proof-of-concept exploit code has been confirmed. The remediation status is marked as “Official Fix,” indicating that a patch is readily available.

The vulnerability specifically impacts Microsoft Teams for Android. The patched version is build number 1.0.0.2026092103. Users must manually apply the update, which is available through the Google Play Store.

Patch and Disclosure

Microsoft has released a security update for Microsoft Teams for Android via the Google Play Store. Users and administrators are strongly advised to update to the latest build immediately to mitigate the risk. Security researcher Ofek Levin from Enclave is credited with responsibly disclosing this vulnerability to Microsoft through a coordinated disclosure process.

Organizations operating Microsoft Teams in regulated or high-security environments should prioritize applying this patch, particularly on mobile endpoints where Teams is used for critical business communications.

What You Should Do

• Update Immediately: Ensure all Microsoft Teams for Android installations are updated to build number 1.0.0.2026092103 or later via the Google Play Store.
• Educate Users: Remind users to remain vigilant about suspicious links or communications, even those that appear to originate from trusted sources within Teams.
• Prioritize Mobile Endpoint Security: For organizations, emphasize the importance of mobile device management (MDM) and ensure timely patching of all business-critical applications on mobile endpoints.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.