CVE-2026-80097 - Microsoft Authenticator Elevation of Privilege Vulnerability

Lookout Coverage and Recommendation for Admins

Lookout will release security coverage for CVE-2026-80097 on November 5, 2026. Upon deployment, the platform will automatically trigger alerts and remediation workflows aligned with each organization’s configured risk thresholds and escalation policies. To ensure devices remain protected, administrators should take the following steps in their management console:

Enforce Minimum Application Version: Mandate that all Android devices running Microsoft Authenticator update to version 6.2606.4246 or higher.
Restrict Non-Compliant Devices: Set compliance policies to block devices running outdated versions of Microsoft Authenticator from accessing corporate email, files, and applications until the update is installed.
Audit Device App Catalogs: Review app inventories across enrolled and BYOD devices to identify and remove any unauthorized or sideloaded applications.
Revoke At-Risk Sessions: For any device confirmed to have run an outdated version alongside untrusted applications, sign the user out of all active corporate sessions and invalidate their current refresh tokens to stop unauthorized access.
Monitor Sign-In Activity: Review corporate identity logs for unusual access patterns, unfamiliar locations, or atypical spikes in data downloads tied to mobile accounts.

Overview

Microsoft has disclosed an elevation of privilege vulnerability, CVE-2026-80097 (CVSS 3.1: 8.6 / High), in Microsoft Authenticator for Android—the broker application widely deployed by enterprise organizations to manage mobile identity, Single Sign-On (SSO), and Multi-Factor Authentication (MFA).

The flaw affects versions of Microsoft Authenticator for Android prior to build 6.2606.4246. It allows an unprivileged application installed on an Android device to silently obtain access tokens for a signed-in corporate account without any user interaction, permission prompts, or consent screens. Microsoft addressed the vulnerability by enforcing caller signature verification on the exported broker activity.

The patch was published on September 8, 2026, and fixed builds are available via the Google Play Store and enterprise app management catalogs. Organizations must ensure Microsoft Authenticator for Android version 6.2606.4246 or later is enforced across all enrolled and BYOD devices.

While CISA has not yet added CVE-2026-80097 to its Known Exploited Vulnerabilities (KEV) catalog at the time of publication, its attack profile—zero permissions, zero user interaction, high-privilege token access, and broad enterprise deployment—makes it a high-priority threat. Organizations should treat remediation as an immediate priority rather than waiting for formal KEV listing.

Lookout Analysis

Because Microsoft Authenticator serves as the authentication broker on Android, other productivity applications delegate token acquisition to it rather than storing separate credentials. A flaw in this boundary compromises the mobile identity perimeter.

Attack Lifecycle

Lure & Delivery
The attacker tricks a target into installing a seemingly benign application—such as a simple calculator, flashlight utility, or casual game. The application requires no special Android permissions, security privileges, or suspicious declarations during installation.
Silent Co-Location
Once installed on an Android device where a user has already registered and signed into their corporate Microsoft account, the application waits for an opportune moment to run in the background or upon being opened.
Impersonation & Exploitation
The malicious application asks Microsoft Authenticator for access by falsely claiming to be a trusted corporate service (such as Microsoft Teams or Outlook). Because the vulnerable Authenticator app fails to verify the true identity of the requester, it blindly trusts the claim and hands over active corporate access tokens. This step occurs silently—generating no login pop-ups, multi-factor prompts, or user consent dialogues.
Account Takeover & Data Exfiltration
Equipped with these legitimate enterprise tokens, the attacker inherits the full permissions of the employee's work identity. The attacker can directly read or download sensitive corporate emails, chat history, internal documents, and calendar events, completely bypassing standard identity checks and Multi-Factor Authentication.