Published on May 13, 2026
Microsoft Teams Vulnerability Allows Spoofing Attacks on Android Devices
Severity
Medium
Detail
Microsoft has disclosed a security vulnerability affecting Microsoft Teams for Android that could allow attackers to perform spoofing attacks against users and organizations. The vulnerability tracked as CVE-2026-32185, was released as part of Microsoft’s May 2026 Patch Tuesday security updates. The flaw is caused by improper handling of file and directory access within Microsoft Teams for Android. Due to this weakness, unauthorized local attackers may manipulate or impersonate trusted content inside the application, potentially deceiving users into interacting with malicious communications or files that appear legitimate.
Although vulnerability requires local access and user interaction, security experts warn that the impact on data confidentiality could be significant, especially in enterprise or regulated environments where Microsoft Teams is heavily used for business communications. At the time of disclosure, there is no evidence of active exploitation or publicly available proof-of-concept code. Microsoft categorized the vulnerability as “Exploitation Less Likely”; however, organizations are strongly encouraged to apply available security updates immediately to reduce potential risks.
| CVE ID | Summary | CVSS Score |
| CVE-2026 32185 | Improper file and directory access handling in Microsoft Teams for Android allows local attackers to perform spoofing attacks through malicious content impersonation. | 5.5 (Medium) |
Affected Products
The vulnerability affects Microsoft Teams for Android versions prior to 1.0.0.2026092103.
Recommendation
Organizations and administrators are strongly advised to take the following actions immediately:
- Update Microsoft Teams for Android to version 1.0.0.2026092103 or later through Google Play Store
- Enforce mobile device management (MDM) policies to ensure security updates are applied promptly
Source
https://app.opencve.io/cve/CVE-2026-32185
https://cybersecuritynews.com/microsoft-teams-vulnerability-spoofing/