CVE-2026-65667 Gave Teams a 10.0. Here's What Actually Needs Patching

On August 6, 2026, Microsoft published 20 cloud service vulnerabilities in one batch. Three of them are scored 10.0, the maximum on the scale. And one of those three is Microsoft Teams.

Teams is the tool Japanese offices talk to each other on every day, so seeing that name on the list stops people mid-scroll. But to give the answer first: none of the 20 requires anything from you. There is no update to install. Microsoft states it in its own advisories:

This article keeps track of the Microsoft cloud vulnerabilities classified as "severe on paper, no work for the customer". The 20 entries from August 6 come first as the newest batch, followed by the single entry from July 30 and the 14 from July 23. They all reach the same conclusion; only the contents differ.

Rather than judging by the scores, we queried Microsoft's published data for all 20 entries, one at a time. Here is what came back.

[Update, August 13, 2026] 20 entries in August, three of them 10.0 — Teams tops the list

The disclosure went out on August 6, 2026 (the small hours of August 7 in Japan) and sits in Microsoft's "August 2026" release bucket. All 20 are cloud-side services, and all 20 are classified as requiring no customer action.

The field we checked is customerActionRequired in Microsoft's published data — whether the customer has work to do. All 20 came back false. Alongside it, the flag for whether exploitation has been observed reads no for all 20, and the flag for pre-disclosure leaks reads no for all 20 as well.

The "Sign-in" column says whether the attacker needed an account. "Not needed" means the flaw was open to anyone who wanted to try it. To repeat, though, this describes the state before the fix — none of it works now.

CVE-2026-65667: Teams skipped a permission check

Of the 20, this is the one that touches the most people. Severity 10.0, type elevation of privilege. Microsoft's own wording: "Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network."

"Missing authorization" means the check for whether the caller was allowed to perform the operation never happened at all. The lock was on the door, but you could walk through without showing a key. In vector form: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. Over the network, without difficult preconditions, without a sign-in, without any action from a user, and with impact reaching beyond the service itself (S:C) — that combination is what a 10.0 usually looks like.

Even so, no customer action is required. Teams is a service Microsoft runs, and the place to fix it is on Microsoft's side. Updating the Teams app on your PC or phone has nothing to do with this entry. It is already fixed.

Teams appears three times in the August batch alone

This one is easy to miss, so it is worth stating: 3 of the 20 are Teams.

The first is CVE-2026-65667 (10.0) above. The second is CVE-2026-62896 (9.6), a flaw in the identity check itself: someone who could sign in was able to obtain higher privileges than they should have had. The third, CVE-2026-62918 (7.5), is a different type — spoofing. Digital signature verification (the mathematical proof that a sender is who they claim to be) was inadequate, leaving room to impersonate someone else.

None of the three requires action, but the fact that one service produced three entries at once is itself information. Teams is where internal messages, meetings and file exchange all converge. That also means it is being probed.

The other two 10.0 entries: a database and a satellite-data platform

CVE-2026-56162 is Azure SQL Database, the database service companies run in the cloud. A faulty identity check allowed privileges to be seized without signing in. Of the three, this is the one closest to the business data Japanese companies actually hold. Its impact metrics read C:H/I:H/A:H — high on all three: readable, alterable, and stoppable, the full set.

The other, CVE-2026-63508, is Microsoft Planetary Computer Pro, a research platform for Earth observation data such as satellite imagery and weather records. A critical function had no authentication on it. As the name suggests, its uses are narrow, and ordinary companies almost never run it.

SharePoint and Copilot Cowork needed the user to do something

These two are a different shape. CVE-2026-70332 (SharePoint, 9.6) and CVE-2026-59118 (Copilot Cowork, 9.3) both carry UI:R in their vectors, meaning the attack only worked if a user clicked or otherwise interacted.

The SharePoint one worked by making the server send traffic somewhere else — using SharePoint as a stepping stone to reach locations that should only be visible from inside the network. We also keep a separate roundup of SharePoint vulnerabilities. This entry, however, concerns the cloud edition rather than SharePoint installed on your own servers, and is a different animal.

All 20 are rated "no exploit code available"

Every one of the 20 vectors ends the same way: E:U/RL:O/RC:C. Three things.

• E:U ── no working exploit code has been observed
• RL:O ── an official fix already exists
• RC:C ── the flaw itself is confirmed (not a false report)

In other words: a real flaw, no attack tooling in circulation yet, and the repair already done. We also checked CISA's list of vulnerabilities under active attack. None of the 20 appears among the 1,661 entries in the August 6, 2026 version (you can confirm this on our KEV dashboard).

So is there nothing to do about the August batch?

For these 20, no. To avoid a misreading, though: this does not mean "there is nothing to do about Microsoft's August updates".

These 20 cover cloud-side services only. Software sitting on your own PCs and your own servers — Windows, Office, Exchange Server — gets its updates separately. Keep the August monthly release (the second Tuesday, August 11) apart from the 20 entries here, and apply it as usual. We also cover the monthly-update vulnerabilities IT teams should prioritise.

July went the same way. The six entries scored 10.0 needed no action, while a single entry scored 3.1 was the one that required an update. That inversion is documented in the July sections below.

The August 11 monthly update is a different matter — and Teams has three "action required" entries in it

Everything up to here concerns the cloud side, published on August 6. Five days later, on August 11, the usual monthly release arrived — the second-Tuesday batch of updates you install on PCs and servers. That one does require you to do something.

And there is a point in it that matters for readers of this article. Three Teams vulnerabilities classified as requiring customer action were published on August 11 as well. They are separate from the three Teams entries of August 6.

The difference is where the flaw sits. The three from August 6 were on Microsoft's servers, and Microsoft fixing them was the end of it. The three from August 11 are in the Teams app on your phone itself. A fixed build being released changes nothing while you stay on the old one. Update the Teams app through Google Play on Android or the App Store on iPhone. All three are rated as having no observed exploitation and no pre-disclosure leak.

One vulnerability in that batch is already under attack

The August 11 monthly release covered 400 vulnerabilities in Microsoft products alone, 42 of them in the most severe "Critical" band. The breakdown: 237 in Windows, 95 in Office, 27 in the SharePoint you host on your own servers, and 7 in Exchange Server.

One of them has been confirmed as already used in real attacks: CVE-2026-68820, a flaw in the Windows networking component afd.sys, scored 7.0. Lower than the 10.0 on the Teams entry above if you go by the number alone, and yet this is plainly the dangerous one. CISA added it to its catalog of vulnerabilities under active attack on August 11, the same day it was published, and required US federal agencies to remediate it by August 25. Two further entries had leaked before publication (CVE-2026-62832 and CVE-2026-72971).

In Japan, JPCERT/CC and the IPA (Information-technology Promotion Agency) both issued advisories on August 12 calling for the updates to be applied. The "no action needed" in this article refers to the 20 cloud entries of August 6; the August 11 monthly update should be applied as usual.

Why the count differs from one outlet to the next

Line up the coverage of the August 11 release, in Japan and abroad, and the totals do not agree: 399, 400, 401, 421. Nobody miscounted. Outlets simply draw the line around "this month's batch" in different places.

The main variables are whether cloud-side CVEs of the kind this article covers are counted, and whether Microsoft Edge (shipped on its own track because it is built on Chromium) is included. The size of the total means nothing. The only figure with any operational meaning is how many of them are updates you have to install. This month that is the August 11 release; from the 20 entries of August 6, it is zero.

One more 10.0 landed on July 30 — Azure Cosmos DB (CVE-2026-66803)

Right after this article went up, on July 30, 2026, Microsoft published CVE-2026-66803 on its own — remote code execution in Azure Cosmos DB, rated 10.0. A maximum score on an Azure database service, and yet the conclusion is exactly the same as for the six covered below: there is nothing for you to do.

We pulled the single record from Microsoft's published data to check. customerActionRequired is false, exploitation is marked as not observed, and there was no pre-disclosure leak. Its revision history is a single initial entry, and it sits in the same "July 2026" release bucket as the batch below. A 10.0 and whether you personally have work to do are, once again, two different questions.

The "no action" entry that turned out to be the most frightening research of the lot

This one entry is worth going into a little further. Among the CVEs classified as requiring no action, CVE-2026-66803 stands head and shoulders above the rest in terms of substance.

It was found by the research team at Wiz, a US company that investigates cloud security. They published their findings under the name "CosmosEscape", subtitled "Taking Over Every Database in Azure Cosmos DB".

The chain went like this. Cosmos DB offers a query capability for searching the relationships between pieces of data. The researchers first escaped the isolated compartment that processes those queries, then got as far as running their own code on the shared entry point through which every customer's traffic passes. There they obtained the key used to sign for the service as a whole, and ended up able to issue administrative keys for any customer's database. In other words, they reached a position from which they could read and write at will, including other companies' tenants.

The report was filed on November 20, 2025. Microsoft put in an emergency fix two days later, on November 22, completed the permanent fix across every region worldwide in July 2026, and published on July 30 — in that order. The company states that it found no trace of malicious activity beyond the research team's own testing, and that no customer data was accessed.

The account posting is a Wiz researcher and one of the people who found this CVE. It captures the point neatly: "no action required" does not mean "this does not matter". There is simply no moment at which the customer has to do anything; the substance is research at the level the industry talks about. Incidentally, at the time of writing we could not find a single Japanese-language write-up of this one.

That brings the count of cloud flaws disclosed in July 2026 at 10.0 with no customer action required to seven. The tables below still describe the 14 entries from the July 23 batch, so the numbers there are unchanged — read them as one short of the July total.

One more thing worth stating plainly: none of the 14 classifications this article verified at publication has changed as of August 5. Microsoft does revise entries after the fact, and a change in classification would overturn this article's conclusion, so we re-queried every one of them. All still read customerActionRequired: false, and all still record no exploitation. The single revision was to CVE-2026-62835 (Azure Portal), explicitly labelled as a correction to the description and title only.

Since then, the August cloud batch was published on August 6, 2026: 20 entries, three of them scored 10.0. The details are at the top of this article.

On July 23, 2026, Microsoft published information on 51 security flaws at once. Six of them carry a severity rating of 10.0 — the maximum possible score. Azure Key Vault, Azure DNS, Exchange Online. If you run any of those, the names alone are enough to make you stop what you are doing.

And yet, for those six, there is nothing for you to do. No update exists to install. Microsoft says so directly in its own advisory: "This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take."

Meanwhile, one flaw published the same day with a severity of 3.1 does require you to install an update. On this particular day, the size of the number and the amount of work on your plate run in exactly opposite directions. This article breaks down how those 51 flaws actually split, based on a one-by-one review of Microsoft's published data.

The 51 flaws published on July 23 fall into two groups

Microsoft publishes vulnerability information through its Security Update Guide, and each entry carries a field called customerActionRequired. Sorting the 51 entries from July 23 by that field gives the following picture.

Every 10.0 sits in the top row. All 14 entries in that row need no action from you, while the 37 entries in the two lower rows — the ones with the smallest numbers — are the ones that require work. The severity scores and your workload are lined up in opposite order on this day.

The reason is straightforward. Flaws in cloud services are fixed on Microsoft's own servers. There is no software on your side to patch. Azure Linux (the Linux distribution Microsoft ships for its own cloud, previously called Mariner) and Edge, on the other hand, run on your servers and your machines, so they stay broken until you update them.

The kind of attacker who would want these six

Nobody spraying mass phishing goes after the foundations of a cloud platform. The relevant attacker is the kind who studies a cloud provider's own services looking for a route across the boundary into someone else's tenant. Build that route once and it reaches every company sitting on the platform. Expensive work, but the arithmetic pays off.

Against a shared cloud platform, the move is to exploit the gaps in identity and permission checks to reach into territory that should be closed to them. Key Vault means the passwords and keys deposited there. Azure DNS means the settings that point traffic at a different server. Exchange Online means message contents and delivery records.

Individuals using the service would lose data without having made any mistake of their own, and companies would find the leak coming from the shared layer they entrusted to someone else rather than from servers they control. In this case, though, Microsoft states there is no observed exploitation and the fixes are complete. This is not a warning about something coming. It is a report that something was closed before it arrived.

If no action is needed, why issue a CVE at all?

A fair question: if customers do nothing, why publish? This is the result of a policy Microsoft adopted in 2024. The company decided to issue CVE identifiers for cloud service vulnerabilities as well, publishing them even when no customer-side work follows. The FAQ on these entries states the purpose plainly.

So these 14 entries are not "this is dangerous, please fix it" notices. They are after-the-fact reports saying "this flaw existed and we fixed it." Good news for customers, but in vulnerability databases they line up in exactly the same shape as everything else, which leaves the number 10.0 free to travel on its own.

Coverage and the official record do not match

Several English-language outlets covered the Azure Key Vault entry (CVE-2026-62825) on its own, urging readers to review vault access permissions and prepare to rotate their secrets. Given a 10.0 attached to a service that holds keys, the instinct is understandable.

But Microsoft itself asks for none of that. The published customerActionRequired value is false, and the FAQ is a single sentence saying there is no action to take. Exploitation is marked "No," prior public disclosure "No." Rotating keys is sound practice on its own merits, but it has not been presented officially as an urgent step justified by this vulnerability.

This article grounds its judgement in Microsoft's published data. If confirmed exploitation or further advisories appear, we will update this page.

The 37 entries that actually require work

The same July 23 batch also carried 37 entries that do need updates. Less headline-friendly, but this is where the work is.

Azure Linux (Mariner): 25 entries

Severities run from 3.1 to 7.5, with nothing dramatic. Azure Linux frequently runs underneath AKS nodes and container platforms on Azure, which means you may be running it without ever having chosen it. Package updates address these. The lowest, CVE-2026-55708, is scored 3.1 and is still classified as requiring customer action.

Microsoft Edge: 12 entries (CVE-2026-16413 through 16424)

Edge is built on Chromium, the same foundation as Chrome, so fixes made upstream arrive as Edge updates. These 12 are that intake. Edge updates itself by default, so in most environments this happens on its own, but anywhere auto-update is disabled needs attention.

The following day, July 24, Microsoft added three Edge-specific flaws (CVE-2026-57989, 57990 and 57978). Two are scored 7.4 and require a specific sequence: visiting an attacker-controlled page and then performing two tap gestures that trigger autofill, after which information can be read. The fixed build is Edge 150.0.4078.99, released July 24 and based on Chromium 150.0.7871.187. On July 25, four more Chrome-side flaws (CVE-2026-16804 through 16807) were taken into Edge as well. Browser-side history is collected in our Chrome and Edge V8 zero-day roundup.

Does this affect you? A quick reference

To check your Edge version, open Edge, click "…" at the top right, then "Help and feedback" → "About Microsoft Edge." Opening that screen triggers an update check on its own.

Note that the July 14 Patch Tuesday release is a separate matter and does contain items requiring real work, including an unauthenticated takeover in SharePoint Server. Those are covered in our July 2026 Microsoft monthly update roundup.

Frequently asked questions

Is it really true that a 10.0 needs no response?

According to Microsoft's published data, yes. A CVSS severity score measures how bad the outcome would be if the flaw were exploited. It does not measure what you should do. These six were published in an already-fixed state, before any exploitation occurred.

Should I rotate my passwords and API keys?

Microsoft has not asked for rotation on the basis of these entries, and exploitation is marked as not observed. Periodic rotation is good hygiene in general, but no official instruction exists to treat it as an emergency step here.

Are any of these in the US government's exploited-vulnerabilities list?

No. As of August 13, 2026, all 35 — the 20 published in August, the 14 published on July 23, and CVE-2026-66803 from July 30 — are absent from the list. We checked against CISA's catalog of vulnerabilities confirmed as exploited (KEV), version 2026.08.11, 1,665 entries. Widening the check to all 41 cloud CVEs that Microsoft classified as requiring no action across July and August returns the same answer: zero.

The contrast is the six Microsoft product vulnerabilities that were added to KEV over those same two months: three in SharePoint Server (the edition you host yourself), one in Active Directory's federated authentication, and one each on July 14 and July 22 — plus CVE-2026-68820 (Windows), added on August 11. All six are products where the customer has to install an update. CVE-2026-45659, added on July 1, has even been confirmed as used by ransomware.

Beyond that, no Azure service has ever been added to KEV in the entire history of the catalog. A flaw that ends the moment Microsoft fixes it has no business on a list of things customers must fix urgently. Given a 10.0 that is not in KEV and a 7.0 that is, the urgent one is the 7.0.

Have Japanese authorities issued advisories?

Not in the form of an advisory. JPCERT/CC and the IPA both published advisories about the monthly update on August 12, but what they name there is CVE-2026-68820, the one under active attack; the 20 cloud entries covered in this article are not mentioned.

One thing did catch our eye while checking, though. JVN iPedia, the Japanese domestic vulnerability database, has registered every one of them in Japanese, including the three Teams entries. CVE-2026-65667, for example, appears as "elevation of privilege vulnerability in Microsoft Teams".

The problem is the countermeasures field on those pages. Every one of them carries nothing but the boilerplate "refer to the vendor's information and apply appropriate countermeasures" — no mention that Microsoft has already fixed the flaw, and none that no customer action is required. Anyone following only the Japanese-language sources will keep searching for an update that does not exist.

Conversely, CVE-2026-68820 — the one actually being exploited — was still not registered in JVN iPedia as of August 13. What needs no action can be read in Japanese; what is urgent right now cannot. The order is backwards, which is precisely why an article like this has to query each entry individually and check.

Will updating the Teams app make me safe?

For this entry, updating makes no difference. CVE-2026-65667, the one scored 10.0, is a flaw on the service Microsoft runs, not in the Teams app installed on your PC or phone. The fix belongs on Microsoft's side, and it is already done. Keeping the app current is a good habit in its own right, but it is not something to do on account of these 20.

That said, the three Teams entries published on August 11 are a different story, and those do require you to update the app (the Android and iOS editions are affected). Teams produced both "no action" and "action required" entries in the same month, so do not conflate the two.

Does that mean the August monthly update (August 11) needs nothing either?

No — that is a separate matter. The August 11 release covered 400 vulnerabilities in Microsoft products, 42 of them in the most severe "Critical" band, and all of them need to be applied. They include CVE-2026-68820, which has been confirmed as used in real attacks. The 20 entries in this article cover only the cloud side of the August 6 disclosure, and are an entirely separate matter from the monthly update.

Note also that the August 11 batch includes three Teams entries that do require customer action. Update the app on your phone. The details are in the section "The August 11 monthly update is a different matter" earlier in this article.

I use Azure App Service. Am I at risk?

CVE-2026-58630 applies to "Azure App Service on Azure Stack Hub" in Microsoft's official title. That is the edition installed in your own data center, and it is a different product from App Service running on Azure. The database summary drops the qualifier, which makes the summary alone easy to misread.

Summary

The August 6, 2026 batch runs to 20 entries. Three are scored 10.0, and one of those three is Microsoft Teams. Azure SQL Database, the Microsoft 365 admin center, SharePoint, Copilot Cowork and Azure Active Directory are on the list too — names people recognise. But all 20 have been fixed on Microsoft's side, and no update exists for customers to install. Observed exploitation is zero, and exploit code is rated as unavailable.

July was the same. Of the 51 entries from July 23, the 14 cloud entries — including all six scored 10.0 — required no action. The actual work sat with the 25 Azure Linux entries scored between 3.1 and 7.5 and the 12 Microsoft Edge entries. A further 10.0, in Azure Cosmos DB, was added on July 30.

That is three months in the same shape. A severity score is not your task list. Now that Microsoft issues CVE identifiers for cloud flaws too, this kind of "10.0 you only need to read" will keep arriving on a regular basis. Before reacting to the number, check whether an update exists to install at all. For a cloud-side service, the answer is usually that it does not.

The distinction does matter, though. Updates for software sitting on your own machines, such as Windows and Office, ship separately from all of this. The August 11 monthly release covered 400 vulnerabilities in Microsoft products alone, 42 of them Critical, and one of them was already being exploited. Teams, too, had three entries that day requiring a customer update. Microsoft now routinely puts "no action" and "action required" under the same product name in the same month. Judge by the classification in the published data, not by the name.

Finally, a word about this article's own corrections. The August batch was originally given as 17 entries; a re-query turned up three that had been missed, and the figure is now 20. The service name on CVE-2026-59118 has likewise been changed to "Copilot Cowork", following Microsoft's revision of the official title on August 11. An article that goes to the published data is worth nothing unless it is corrected when that published data is rewritten. We will keep tracking this the same way.

References

• ・MSRC — CVE-2026-65667 (Microsoft Teams elevation of privilege, severity 10.0)
• ・MSRC — CVE-2026-56162 (Azure SQL Database elevation of privilege, severity 10.0)
• ・MSRC — CVE-2026-63508 (Microsoft Planetary Computer Pro elevation of privilege, severity 10.0)
• ・MSRC — CVE-2026-62896 (Microsoft Teams elevation of privilege, severity 9.6)
• ・MSRC — CVE-2026-62918 (Microsoft Teams spoofing, severity 7.5)
• ・MSRC — CVE-2026-70332 (Microsoft Office SharePoint spoofing, severity 9.6)
• ・MSRC — CVE-2026-59118 (Copilot Cowork elevation of privilege, severity 9.3)
• ・MSRC — CVE-2026-62873 (Microsoft 365 admin center elevation of privilege, severity 9.8)
• ・MSRC — CVE-2026-50481 (Azure Active Directory elevation of privilege, severity 9.9)
• ・MSRC public API (customerActionRequired, exploited and publiclyDisclosed queried for all 20 August entries on August 7, 2026)
• ・Microsoft Security Response Center — CVE-2026-62825 Azure Key Vault Elevation of Privilege Vulnerability
• ・MSRC — CVE-2026-56163 Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
• ・MSRC — CVE-2026-56191 Microsoft Exchange Online Tampering Vulnerability
• ・MSRC — CVE-2026-58275 Azure DNS Elevation of Privilege Vulnerability
• ・MSRC — CVE-2026-58630 Azure App Service on Azure Stack Hub Elevation of Privilege Vulnerability
• ・MSRC — CVE-2026-57106 Data Quality Elevation of Privilege Vulnerability
• ・MSRC — CVE-2026-57989 Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
• ・Microsoft — July 2026 Security Updates release notes
• ・Microsoft — Toward greater transparency: Unveiling Cloud Service CVEs
• ・NVD — CVE-2026-62825
• ・CWE-287: Improper Authentication
• ・GitHub — microsoft/azurelinux (formerly CBL-Mariner)
• ・MSRC — CVE-2026-50516 (Azure Kubernetes Service elevation of privilege, severity 9.4)
• ・MSRC — CVE-2026-62869 (Microsoft Entra ID spoofing, severity 8.8)
• ・MSRC — CVE-2026-63522 (Azure SQL Database elevation of privilege, severity 7.8)
• ・MSRC — CVE-2026-68820 (Windows AFD for WinSock elevation of privilege, exploitation confirmed)
• ・MSRC — CVE-2026-65768 (Microsoft Teams for Android, customer action required)
• ・Wiz — CosmosEscape: Taking Over Every Database in Azure Cosmos DB (July 30, 2026)
• ・JPCERT/CC — Advisory on the August 2026 security updates for Microsoft products (August 12, 2026)
• ・IPA — On countermeasures for Microsoft product vulnerabilities (August 2026)
• ・CISA — Adds Three Known Exploited Vulnerabilities to Catalog (August 11, 2026)