Vulnerability · Published Oct 14, 2026 · Assigned by twcert
CVE-2026-110444TEAMPLUS TECHNOLOGY｜TeamPlus Messenger - Code Injection
High 8.8
In plain English
A high-severity code injection in TeamPlus Messenger from TEAMPLUS TECHNOLOGY. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.6%top 51.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into opening a crafted link to inject and execute arbitrary JavaScript. After the user confirms a Windows security warning, attackers can execute arbitrary code with the privileges of the current user.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TEAMPLUS TECHNOLOGY | TeamPlus Messenger | 16.8.0 – through 17.0.6 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://www.twcert.org.tw/tw/cp-132-11270-88d86-1.html third-party-advisory
- https://www.twcert.org.tw/en/cp-139-11271-be75e-2.html third-party-advisory