CVE-2026-80097

Think of Microsoft Authenticator as a trusted “key” that helps logins verify a real person. This flaw would let a bad actor on the device potentially “get more power than they should,” which can increase the chance of breaking into accounts that rely on it.

You should care if your business requires employees to use Microsoft Authenticator on Android phones for sign-ins or verification. This is a local, device-side problem, so the risk depends on whether an attacker can interact with the device in the relevant way. Without being able to reach or trigger it on an affected device, the exposure is much lower.

This is a RED issue because Microsoft Authenticator has a local elevation of privilege weakness that can enable an attacker to gain higher privileges on an Android device. Even though there’s no confirmed public exploit code on record, the presence of a vendor patch means this should be treated as urgent to prevent device/account compromise paths.

1. Inventory and check versions:
   • On every Android device where Microsoft Authenticator is used for work accounts, open Microsoft Authenticator.
   • Look for the version number in the app’s settings/about screen.
   • Record which devices are below 16.3.0.
2. Upgrade to the fixed version:
   • Update Microsoft Authenticator for Android to exactly 16.3.0.
   • Re-check the in-app version after the update to confirm it is 16.3.0.
3. Validate sign-in behavior:
   • Test that Microsoft Authenticator still generates codes/approvals correctly for at least one work account.
   • Ensure employees are not prompted unexpectedly or blocked after upgrading.
4. If patching is delayed (practical mitigation):
   • Reduce reliance on those specific Android devices for critical logins until updated.
   • If your accounts support it, temporarily favor an alternative sign-in method/device for high-risk access while the affected devices are being updated.
5. Monitor after remediation:
   • Watch for any unusual sign-in failures or repeated authentication prompts tied to affected users/devices.
   • Confirm no new app-side errors appear after the update.

CVE-2026-80097 is an elevation of privilege vulnerability in Microsoft Authenticator for Android (CWE-287). The weakness is related to improper authentication/authorization handling that can allow an attacker to gain higher privileges locally on the device. A vendor fix is available in Microsoft Authenticator for Android version 16.3.0. KEV is not listed in CISA KEV and there is no public exploit code recorded; exploitation maturity is therefore not confirmed from the provided findings. The traffic-light verdict is RED, driven by the availability of a patch and the local privilege escalation risk on a security-sensitive authentication app.