CVE-2026-80097
Microsoft Authenticator Elevation of Privilege Vulnerability
Microsoft Microsoft Authenticator for Android
CVSS
8.6HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.53%Chance of exploitation activity in the next 30 days, higher than 44% of CVEs. Scored 27 Oct 2026FIRST EPSS
What fixes it
- 6.2606.4246Microsoft Authenticator for AndroidCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Timeline
- 8 Sep 2026, 17:13 UTCPublishedCVE List
- 27 Oct 2026, 08:18 UTCFirst reportBluesky: CVE posts
- 27 Oct 2026, 14:28 UTCExploit code publicGitHub proof-of-concept repositories
Reports 8
3 outlets mention it. Reports are not confirmation; each links to its source.
- @postac001.bsky.social: Microsoft Authenticator (Android v6.2606.4246)で、権限のないアプリが作業アカウントのトークンを盗める脆弱性（CVE-2026-80097）が修正されまし…Bluesky: CVE posts, 27 Oct 2026
- @microsofters.com: Un fallo de Microsoft Authenticator permitía acceder a correos y archivos sin conocer la contraseña. La vulnerabilidad CVE-2026-80097 afectaba a Android y ya ha sido corregida por Bluesky: CVE posts, 27 Oct 2026
- @microsofters.com: Un fallo de Microsoft Authenticator en Android permitía acceder a correos y archivos de cuentas corporativas de Microsoft 365 sin conocer la contraseña. La vulnerabilidad CVE-2026-Bluesky: CVE posts, 27 Oct 2026
- Ghost-Bx1/AuthenticatorFlaw-CVE-2026-80097: CVE-2026-80097 - Microsoft Authenticator Android Token Theft PoC & ExploitGitHub proof-of-concept repositories, 27 Oct 2026Exploit code
- Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account TokensThe Hacker News, 27 Oct 2026
- @e-kiledjian.bsky.social: Microsoft Authenticator vulnerability let rogue Android apps steal work account access A vulnerability in Microsoft Authenticator for Android, tracked as CVE-2026-80097 and rated CBluesky: CVE posts, 27 Oct 2026
- @veduis.bsky.social: Microsoft Authenticator for Android is patched against CVE-2026-80097, rated CVSS 8.6 and high severity. Untrusted apps could impersonate Microsoft apps and obtain delegated accounBluesky: CVE posts, 27 Oct 2026
- @appinn.bsky.social: 微软的身份验证工具 Microsoft Authenticator 被发现存在一个高危漏洞（CVE-2026-80097），CVSS 评分为 8.6 分。 攻击者只需要诱导用户安装一个恶意安卓应用，即使这个 AppBluesky: CVE posts, 27 Oct 2026
Description
Improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally.
Text from CVE List
Affected versions 1
- Microsoft Authenticator for Androidaffected: 6.0.0 before 6.2606.4246CVE List