Microsoft publishes a CVSS 10.0 Teams vulnerability with no affected version and no documented fix
CVE-2026-65667 is an unauthenticated privilege escalation in Microsoft Teams, rated CVSS 10.0, published August 6, 2026 outside the Patch Tuesday cycle. The advisory omits the affected component and the patched build — here's what security teams should do while they wait.
On August 6, 2026, Microsoft published CVE-2026-65667 outside its regular Patch Tuesday cadence. The advisory describes an unauthenticated elevation-of-privilege vulnerability in Microsoft Teams carrying a CVSS 10.0 score — the theoretical maximum. Three days later, on August 8, Microsoft still has not identified which Teams component is affected, nor which build contains the fix.
The CVSS vector is unambiguous: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. In operational terms: a remote attacker, with no authentication and no user interaction, can gain read and write access to resources outside the initial security scope of Teams. The scope change (S:C) indicates the compromise crosses a security authority boundary — typically cross-tenant access or escalation from a standard user context to an administrative one.
A security advisory you cannot act on
The immediate problem is not the vulnerability itself — it is the absence of operational data in the advisory. Microsoft’s Security Update Guide confirms the flaw and its classification, but goes no further. No patched Teams build is listed. No Knowledge Base article is attached. No indication of whether the fix is service-side (Microsoft 365) or client-side.
In a real enterprise environment, this absence creates a dead end. “Teams” can mean the Windows desktop application, the macOS client, mobile clients, the web client, a Microsoft 365 cloud service, or an interaction between several of these components. Each has its own deployment and patching model. Without specifics, an administrator cannot:
- Determine whether their estate is exposed
- Build a compliance query in their endpoint inventory
- Plan a patch deployment
- Document a verified exception
The National Vulnerability Database (NVD) and the CVE program’s public registry had not yet indexed CVE-2026-65667 as of August 8, 2026 — a normal delay after publication, but one that leaves Microsoft’s sparse advisory as the only usable public source.
What the CVSS vector reveals (and hides)
A CVSS 10.0 score places this vulnerability at the absolute top of the scale. But the granularity of the metrics tells a more nuanced story.
What is established:
- AV:N — The attack is reachable from any network that Teams is accessible from (the internet in virtually all deployments)
- AC:L — Attack complexity is low: no complex preconditions
- PR:N — No privileges required: the attacker needs no account
- UI:N — No user interaction: no click-bait, no social engineering
- S:C — Scope change: the impact crosses the vulnerable component’s boundary
- C:H / I:H — High confidentiality and integrity impact: the attacker can both read AND modify
What is not established:
- The precise component: Windows client, web client, backend service?
- Real-world exploitability: Microsoft has not published the Exploitability Index
- The EPSS (Exploit Prediction Scoring System) score: FIRST has not yet calculated it
- Status in the CISA KEV (Known Exploited Vulnerabilities) catalog: no entry as of August 8
The combination PR:N + UI:N + S:C is the signature of a vulnerability that can be exploited at scale by an automated actor. It is this combination — not the 10.0 score itself — that should trigger a priority response.
Why an out-of-cycle publication without details is a signal
Microsoft rarely publishes CVEs outside Patch Tuesday without full documentation. When it does, two scenarios are plausible:
- Imminent external disclosure — A researcher or security vendor is about to publish details, and Microsoft is preempting this by providing a CVE identifier before public disclosure
- Fix currently rolling out — The vulnerability is patched service-side, and Microsoft is waiting for the rollout to complete before documenting the client build, but is publishing the CVE to let organizations track the risk
The second scenario is the more likely one for a Teams service-side vulnerability. Microsoft deploys cloud service fixes continuously, and publishing the CVE before full documentation may simply reflect a synchronization delay between the product team and the security team.
What CISOs and security teams should do now
In the absence of a documented fix, the correct posture is evidence collection and surface reduction, not unsupported emergency change.
Immediate inventory:
- Catalog every Teams deployment channel in use: Microsoft Store, Intune, Configuration Manager, VDI images, any residual classic Teams installations
- Verify that the current Teams client can receive updates in your organization’s managed configuration, particularly if the Microsoft Store is blocked or updates are deferred
Conservative surface reduction:
- Audit Teams administrative roles, guest access settings, external collaboration policies, and privileged Microsoft 365 accounts
- Temporarily restrict guest access and external federation if your organization’s risk threshold justifies it — without presenting this as Microsoft-validated mitigation
Active monitoring:
- Monitor Microsoft’s Security Update Guide entry for CVE-2026-65667 daily
- Watch for the potential appearance of the entry in the CISA KEV catalog — listing there would mean confirmed active exploitation
- Preserve current Teams client versions and update logs to quickly establish compliance once a patched build is published
The fourth measure is counterintuitive but essential: do not close the ticket. An undocumented CVE that drops off the backlog because “Teams appears current on a sample of endpoints” is a CVE that will resurface at the worst possible moment.
The question Microsoft needs to answer
The current advisory is an identifier, not a proper advisory. It meets the minimum requirements of the CVE program — an identifier, a description, a publication date — but none of the operational criteria that allow a security team to turn an alert into action.
Microsoft needs to answer three questions in the coming days:
- Which Teams component is affected: client, service, or both?
- Which build or update resolves the vulnerability?
- Has active exploitation been observed?
Until those answers are public, CVE-2026-65667 remains an unquantified risk in a product present in virtually every Microsoft 365 environment. That is not a reason to panic — it is a reason to be ready to move the moment the information arrives.