This vulnerability in Microsoft Teams is due to missing authorization controls, enabling an attacker without prior privileges to elevate their privileges remotely over the network. The CVSS 3.1 base score is 10.0, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and complete confidentiality and integrity impact with no availability impact. Microsoft has issued an official fix for this vulnerability.

An attacker can gain elevated privileges remotely without authentication, potentially leading to full compromise of affected Microsoft Teams instances. The vulnerability impacts confidentiality and integrity but does not affect availability. No known exploits are currently active in the wild.

An official fix is available from Microsoft. Users and administrators should apply the provided patch as soon as possible. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65667 for detailed remediation instructions.