1. Executive summary
CVE-2026-80097 is an improper authentication flaw in Microsoft Authenticator for Android versions before 6.2606.4246. A rogue Android application installed on the same device can impersonate a legitimate Microsoft application and obtain work-account tokens without requesting permissions or prompting the user. The vulnerability is CVSS 8.6 HIGH, is not listed in CISA KEV, and has an EPSS score of 0%. Successful exploitation can expose email, files, calendars, SharePoint sites and Teams messaging, while unauthorised passkey enrolment can preserve account access after the rogue application is removed.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item.
3. Technical analysis & attack chain
The reported attack requires a user to install a rogue application on an Android device where Microsoft Authenticator already brokers access to a work account.
- The user is induced to install a rogue Android application. The source does not identify a delivery method, application package, filename or distribution channel.
- The application opens an externally reachable part of Microsoft Authenticator. The source does not provide the Android component name or class.
- The application requests a token while claiming the identity of a legitimate Microsoft application, such as Teams.
- Authenticator checks whether identity details supplied in the request match the installed legitimate application. Any application can read those details, allowing the rogue application to reproduce them.
- Authenticator does not use the known identity of the calling application to make the trust decision. This is classified as CWE-287, Improper Authentication.
- Authenticator returns the requested token without a user prompt or warning. The researcher’s test application required no Android permissions for this action.
- The token permits access associated with the impersonated application. The reported test demonstrated the ability to read and send mailbox content, read and modify files and calendars, access SharePoint sites, and send Teams messages as the victim.
- By impersonating Authenticator, the test application could create or delete account sign-in methods, including passkeys. An attacker-controlled passkey can preserve access after removal of the rogue application.
All Microsoft Authenticator for Android versions before 6.2606.4246 are reported as affected. Version 6.2606.4246 contains the vendor fix. No affected Android operating-system versions, vulnerable component identifiers or temporary configuration workarounds are provided.
The source describes token acquisition and access to Microsoft 365 data, but it does not report an observed criminal campaign, malware family, command-and-control infrastructure, lateral movement method or completed data exfiltration. No threat actor is attributed. CVE-2026-80097 is CVSS 8.6 HIGH, is not in CISA KEV, and has an EPSS score of 0%; these values do not establish that exploitation has occurred.
The technical findings and demonstrated capabilities are single-sourced to Help Net Security’s account of Enclave’s research. The source states that Microsoft confirmed the issue following responsible disclosure, but no separate Microsoft or Enclave advisory is provided. Verify affected-version and telemetry assumptions before enforcement.
4. Mitigation & containment
- P1, within 24 hours: Update Microsoft Authenticator for Android to version 6.2606.4246 or later through Google Play. Use mobile-device management to enforce 6.2606.4246 as the minimum permitted version and block work-account access from devices that remain below it.
- P1, within 24 hours: For devices suspected of hosting an untrusted application, isolate the device from work-account access. Revoke its active account sessions, inspect registered sign-in methods, remove unauthorised passkeys, and restore approved authentication methods. Removing the application alone may not terminate access if an attacker added a passkey.
- P2, within 72 hours: Review managed Android application inventories for unfamiliar or sideloaded applications on devices using Microsoft Authenticator. Remove unauthorised applications after preserving evidence required for investigation.
- P2, within 72 hours: Review affected users’ mailbox, file, calendar, SharePoint, Teams and sign-in-method activity for actions inconsistent with their normal use. Prioritise accounts that used Authenticator versions before 6.2606.4246 on devices containing unapproved applications.
- P3, within 7 days: Configure mobile-device policy to restrict sideloading and installation from unapproved sources where operational requirements allow. Confirm that compliance reporting can identify Authenticator versions below 6.2606.4246.
5. Indicators of compromise
No indicators of compromise available in the source material.
Behavioural indicators
| behaviour | where to observe | confidence |
|---|---|---|
| A new passkey appears without an authorised user or administrator action | Work-account sign-in-method records | Medium, single-sourced |
| An existing passkey or other sign-in method is deleted without an authorised action | Work-account sign-in-method records | Medium, single-sourced |
| Mail is read or sent through a token obtained by an unauthorised Android application | Mailbox and account activity records | Low, capability described but no observed campaign reported |
| Files, calendars or SharePoint content are accessed or changed without corresponding user activity | Microsoft 365 activity records | Low, capability described but no observed campaign reported |
| Teams messages are sent as the user without corresponding user activity | Teams and account activity records | Low, capability described but no observed campaign reported |
These behaviours are single-sourced; verify before enforcement.
6. Detection
Insufficient indicators to author detection rules.
CVE assessment
1 referenced CVE
| CVE | CVSS | Exploited | EPSS | Summary |
|---|---|---|---|---|
| CVE-2026-80097 | 8.6 High | — | 0% | Improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally. |
7. Sources
- Help Net Security, “Microsoft Authenticator vulnerability let rogue Android apps steal work account access”, https://www.helpnetsecurity.com/2026/10/27/microsoft-authenticator-vulnerability-patchedcve-2026-80097/, 2026-10-27.
8. Adverse Trace position
We assess CVE-2026-80097 as CVSS 8.6 HIGH, consistent with the published score, because a locally installed rogue Android application can silently obtain work-account tokens and may establish persistent access by adding a passkey. The vulnerability is not listed in CISA KEV and its EPSS score is 0%, so current evidence does not support a claim of active exploitation. The reported technical findings are single-sourced; clients should verify before enforcement beyond the immediate version control. Adverse Trace will monitor for independent vendor confirmation, evidence of exploitation and attributable infrastructure, while clients should first enforce Microsoft Authenticator 6.2606.4246 or later and investigate unauthorised sign-in-method changes.
Published via PulseTrace — Adverse Trace threat intelligence.