Users of Microsoft Authenticator for Android should ensure they have the latest version of the application installed on their devices. This update corrects a critical vulnerability that could allow an attacker access to authentication credentials across various services.
The flaw was identified by the digital security company Enclave and received a score of 8.6 (on a scale of 10) in the CVSS 3.1 system, indicating a very high level of severity. According to Enclave, an attacker could exploit this vulnerability by creating an Android application, even without special permissions, pretending to be an official Microsoft application to force Authenticator to send corresponding authentication tokens.
With these tokens in hand, the attacker could gain access to the user's accounts on multiple platforms. In tests conducted by Enclave, it was possible to access confidential information such as emails, calendars, and files.
Enclave notified Microsoft about the vulnerability, and Microsoft acknowledged the issue through the registration CVE-2026-80097, which was made public on September 8, 2026. Although the technical details were only recently disclosed by Enclave, the initial communication occurred promptly.
To mitigate the risk, it is recommended to install version 6.2606.4246 or higher of Microsoft Authenticator. You can check the installed version on your Android phone or tablet by accessing the Microsoft Authenticator page on the Google Play Store.
Microsoft Authenticator is an application compatible with Android and iOS that facilitates two-factor authentication in numerous services. Furthermore, it serves to generate temporary verification codes for logins and allows access to certain Microsoft services without the need to type passwords.