Submit finding

All findings

CVE-2026-42835 high

Enclave's Nice2Meet campaign also maps to Teams CVE-2026-42835

Enclave identifies CVE-2026-42835 as part of its AI-guided Nice2Meet research, while Microsoft's CNA record confirms the high-severity Teams for Android information disclosure.

Bug class
Downstream-component injection and remote information disclosure
Affected codebase
Microsoft Teams for Android
Credited system
Enclave AI
Disclosed
August 12, 2026
Attribution
Self-reported attribution
Severity
high
Source status: Microsoft's CNA record confirms CVE-2026-42835, its 8.1 score, and the patched Teams version. Enclave's Nice2Meet write-up explicitly includes the CVE and says the research was AI-guided.

Summary

CVE-2026-42835 is an injection flaw in Microsoft Teams for Android that lets an authorized network attacker disclose information. Microsoft scores it 8.1 and records the fixed application boundary.

Enclave’s Nice2Meet write-up lists this CVE alongside CVE-2026-65767 and says the campaign was AI-guided research completed through the Enclave Fellowship. The Microsoft record credits Ofek Levin of Enclave but does not name the AI system on this row, so the system attribution is self-reported.

References

Catalogued in the Bugflation public ledger. Disagree with the attribution or severity label? Email the desk.