Meta Addresses Two Medium Severity Vulnerabilities in WhatsApp

Analyticsinsight

Meta Addresses Two Medium Severity Vulnerabilities in WhatsApp

First seen 3 May 2026, 08:29 UTC • •45.6

Article Content

1 / 14

Browse articles

ThreatCluster •May 4, 2026 at 08:02 UTC

•Two medium severity vulnerabilities in WhatsApp have been disclosed and patched.
•CVE-2026-23863 involves attachment spoofing on Windows, while CVE-2026-23866 affects mobile apps.
•No evidence of exploitation has been found, and users are urged to update their apps.

Meta has disclosed two vulnerabilities in WhatsApp, CVE-2026-23863 and CVE-2026-23866, in a security advisory published on May 1, 2026. Both vulnerabilities were discovered through Meta's bug bounty program and are rated as medium severity. CVE-2026-23863 affects WhatsApp for Windows and involves an attachment spoofing issue that could allow malicious files to masquerade as safe documents. CVE-2026-23866 impacts WhatsApp for iOS and Android, allowing unauthorized processing of media content via AI-rich responses for Instagram Reels. Fortunately, there is no evidence that these vulnerabilities were exploited in the wild, and both have been patched. Users are advised to update their apps to ensure protection against these threats. Meta has emphasized the importance of the security research community in identifying these issues before they could be exploited. The vulnerabilities were fixed in April and earlier this year, respectively.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 132d ago How this analysis works

Timeline

2026-01-01

CVE-2026-23863 patched for Windows

2026-04-01

CVE-2026-23866 patched for mobile apps

2026-05-01

CVE-2026-23863 and CVE-2026-23866 published

More articles in this cluster (13)

Threat Graph

10 entities, 21 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (5)

Malware
Phishing
T1059 - Command and Scripting Interpreter
T1566.001 - Spearphishing Attachment
T1566 - Phishing

Vulnerability (2)

CVE-2026-23863
CVE-2026-23866

Affected Platform (3)

Android
IOS
Windows

Relationships

CVE-2026-23863 targets Android
CVE-2026-23863 targets IOS
CVE-2026-23863 targets Windows
CVE-2026-23866 targets Android
CVE-2026-23866 targets IOS
CVE-2026-23866 targets Windows
Malware targets Android
Malware targets IOS
Malware targets Windows
Phishing targets Android
Phishing targets IOS
Phishing targets Windows
T1059 - Command and Scripting Interpreter targets Android
T1059 - Command and Scripting Interpreter targets IOS
T1059 - Command and Scripting Interpreter targets Windows
T1566.001 - Spearphishing Attachment targets Android
T1566.001 - Spearphishing Attachment targets IOS
T1566.001 - Spearphishing Attachment targets Windows
T1566 - Phishing targets Android
T1566 - Phishing targets IOS
T1566 - Phishing targets Windows

Following this threat?

Track CVE-2026-23863 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Cisco FMC Vulnerabilities Under Active Exploitation Cisco's Secure Firewall Management Center (FMC) Software has two critical vulnerabilities, CVE-2026-20079 and CVE-2026-20316, that are currently being exploited by state-sponsored and ransomware actors. CVE-2026-20079, rated 10.0 on the CVSS scale, allows unauthenticated remote attackers to bypass authentication and…

Critical GitLab CVE-2026-85706 Exploited; Microsoft Issues Record 974 Patches A critical CVE-2026-85706 path-traversal vulnerability in GitLab (CVSS 10.0) was exploited in the wild just hours after its disclosure on September 12, 2026. Microsoft released its largest-ever patch batch, addressing 974 vulnerabilities, including several actively exploited Windows flaws. The GitLab flaw allows…