Microsoft closes Teams leak that allowed access without authentication

"Microsoft has fixed a critical security vulnerability inMicrosoft Teamsthat allowed an unauthorized attacker to obtain information about a network. The vulnerability is registered as CVE-2026-21535 and was caused by an error in access control, also referred to as Improper access control. According to Microsoft, an attack did not require authentication, user interaction, or elevated privileges. The vulnerability therefore had a high impact on data confidentiality, resulting in a critical classification and a CVSS score of 8.2."

"The error was located in the Teams cloud service itself and has been completely resolved on the server side. Users and IT administrators do not need to install updates or take additional measures. Microsoft says it is not aware of any active exploitation of the leak. The vulnerability was reported by an external researcher and was disclosed after mitigation via the Microsoft Security Update Guide."

Microsoft fixed a critical improper access control vulnerability in Microsoft Teams, tracked as CVE-2026-21535, that allowed an unauthorized, unauthenticated attacker to obtain information about a network. The flaw required no authentication, user interaction, or elevated privileges, producing a high confidentiality impact and earning a CVSS score of 8.2. The error resided in the Teams cloud service rather than client software and was fully remediated on the server side. No user or IT administrator updates or additional measures are necessary. Microsoft reports no known active exploitation. The issue was reported by an external researcher and was disclosed after mitigation with limited technical detail to reduce reuse risk.

Read at Techzine Global