Microsoft Teams contains an improper access control flaw that allows attackers who are not authenticated to read sensitive information transmitted over a network. The vulnerability is rooted in CWE-284, leading to potential data leakage that could expose private communications, meeting content, or other organizational data. The specified impact is the unauthorized disclosure of information to an attacker, which can undermine confidentiality of organizational assets.

The vulnerability affects Microsoft Teams, as identified by Microsoft and referenced by the CNA. No specific product versions are listed, implying the flaw could exist in multiple or all current deployments of the Teams client and service. Users of any Teams installation should verify the presence of this flaw by consulting Microsoft’s update guide for CVE‑2026‑21535.

The vulnerability has a CVSS score of 8.2, indicating a high severity. The EPSS score is reported as less than 1 %, reflecting a very low probability of exploitation at this time. Microsoft does not list this issue in the CISA KEV catalog. The likely attack vector is a network-based request to the Teams service that bypasses normal authorization checks. If exploited, an attacker could read data without permission; successful exploitation requires only network access and does not necessarily require elevated credentials.