CVE-2026-80097
Android app flaw lets attackers steal work account tokens.
A vulnerability in Microsoft Authenticator for Android allows an unauthorized attacker to elevate privileges locally. This means a permissionless app could steal work account tokens. Microsoft has released a fix in version 6.2606.4246, but it is not yet listed on CISA's known-exploited list.
Microsoft Microsoft Authenticator for Android · Updated 28 Oct · From the public records
Being exploitedNot reportedNo attacks reported in the records
CISA known exploitedNot listedThe US list of flaws under attack
SeverityhighCVSS 8.6 of 10
FixAvailableFixed versions below
Am I affected?
If you run a version older than the fixed one for your line, yes.
| Version line | Fixed in |
|---|---|
| Microsoft Authenticator for Android 6.2606 | 6.2606.4246 |
What to do
- Update Microsoft Authenticator for Android to version 6.2606.4246.
- Ensure all Android devices with Microsoft Authenticator are updated as soon as possible.
- Monitor for any suspicious activity in work accounts.
- Review app permissions on Android devices and remove any untrusted apps.
What happened
- 27 OctThe vulnerability was publicly reported by The Hacker News.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-80097 | Microsoft Authenticator Elevation of Privilege Vulnerability | high 8.6 | No | 0.5% |
Our reporting
We have not reported on it. It is here because the sources below did.
Reported elsewhere
The Hacker News · 27 OctMicrosoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens ↗The records
msrc.microsoft.com: advisory ↗CVE-2026-80097 on NVD ↗Is anything you run affected?Members connect Zotpaper to their AI assistant. It checks your own project against every vulnerability on this page and the others we track, and says what to update.
How it works