CVE-2026-80097

Think of Microsoft Authenticator as a trusted “key” that helps logins verify a real person. This flaw would let a bad actor on the device potentially “get more power than they should,” which can increase the chance of breaking into accounts that rely on it.

You should care if your business requires employees to use Microsoft Authenticator on Android phones for sign-ins or verification. This is a local, device-side problem, so the risk depends on whether an attacker can interact with the device in the relevant way. Without being able to reach or trigger it on an affected device, the exposure is much lower.

This is a RED issue because Microsoft Authenticator has a local elevation of privilege weakness that can enable an attacker to gain higher privileges on an Android device. Even though there’s no confirmed public exploit code on record, the presence of a vendor patch means this should be treated as urgent to prevent device/account compromise paths.