CVE-2026-110445

Summary

TeamPlus Messenger contains a code injection vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript into user sessions. When users interact with malicious content and confirm a Windows security warning, attackers can execute arbitrary code with the user's privileges, potentially leading to full system compromise.

Exploitability

Exploitation is moderately difficult as it requires social engineering to get users to interact with crafted content and confirm a Windows security warning, but once triggered, execution is straightforward with no additional prerequisites.

Blast radius

The vulnerability could impact any user who interacts with malicious TeamPlus Messenger content, potentially affecting organizations that rely on this messaging platform for business communications, with risk escalating based on user privileges and network access.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to TeamPlus Messenger version 2.590 or later to remediate this code injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.