Microsoft Authenticator Android vulnerability: what your business should do

If your team uses Microsoft Authenticator on Android, check that it is up to date. The fix for CVE-2026-80097 is available in version 6.2606.4246 and later. Keep multi-factor authentication switched on.

Recent research has highlighted a weakness that could allow a malicious app on an affected phone to obtain sign-in tokens for a work account. For a business, that could mean access to email, files and other Microsoft services without the attacker first learning the person's password.

The important distinction is that this is newly published research about an already patched vulnerability, not a newly announced flaw with no fix. Microsoft published its advisory on 8 September 2026. Enclave published its research, named AuthMask, on 23 October 2026.

What has happened?

Microsoft Authenticator does more than display codes or ask you to approve a sign-in. On Android, it can also act as a trusted intermediary that helps other Microsoft apps sign you in.

Instead of asking you to enter your password repeatedly, it supplies a digital access pass called a token. That token allows an app to access particular services on your behalf.

Researcher Ofek Levin at Enclave found that a malicious app could pretend to be a trusted Microsoft app already installed on the same device. The vulnerable version of Authenticator did not properly establish that the app making the request was genuinely the one it claimed to be.

Microsoft tracks the issue as CVE-2026-80097, an elevation of privilege vulnerability caused by improper authentication. Its advisory assigns a CVSS 3.1 base score of 8.6 and a Microsoft severity rating of Important.

In plain English, an untrusted app could gain access it should never have been given.

Who needs to check?

The published research concerns Microsoft Authenticator for Android versions earlier than 6.2606.4246, with a work account signed into the app.

Check both:

• Company-owned Android phones used for Microsoft work accounts.
• Personal Android phones staff use for work authentication, even if those phones are not managed by your business.

The demonstrated attack required a malicious app to be installed and running on the affected device. It was not simply an attack that anyone could launch remotely against a Microsoft account with no foothold on the phone.

There is an important nuance about user interaction. Microsoft's advisory describes convincing the user to complete an authentication flow. Enclave reports that its tests obtained tokens without further interaction once the required apps and signed-in work account were present. Do not assume that the absence of an unexpected approval prompt proves a phone or account is safe.

The researchers' demonstrated app did not require Android permissions. An app asking for few or no permissions is therefore not, by itself, a reliable sign that it is harmless.

This particular finding concerns Android. It should not be described as evidence that the same flaw affects the iPhone version, every authenticator app or all accounts that use multi-factor authentication.

What could this mean for your business?

In Enclave's tests, the obtained tokens provided access that included:

• Reading and sending email as the affected user.
• Reading or changing files, calendar information and SharePoint content within the granted access.
• Sending Teams messages as that user.
• Access to authentication-method operations, including passkey creation and deletion, when impersonating Authenticator itself.

Those capabilities could support convincing internal fraud, expose business information or help an attacker maintain access. The exact impact depends on the tokens obtained, the user's permissions and the organisation's security controls. This is not an automatic grant of administrator access to an entire business.

Having an affected version does not mean an account has already been compromised. Microsoft's exploitability assessment stated that exploitation had not been detected at the time of its original advisory. That is a dated assessment, not a guarantee about every device or subsequent activity.

The sensible response is to update promptly and investigate suspicious activity, rather than assume either that every account is compromised or that there is nothing to check.

What should you do now?

1. Update Microsoft Authenticator

Open the Google Play Store, find Microsoft Authenticator published by Microsoft Corporation, and install any available update. Use your organisation's approved app-management process if your phone is managed.

Check that the installed version is 6.2606.4246 or later. The version can normally be found in the app's About information or in Android's app details; the exact location varies by device. Installing the latest available release is preferable to stopping at the minimum fixed version.

Do not download an APK or a supposed security fix from a link in an unexpected email or message. If an update is unavailable or your device cannot run a supported release, ask your IT provider for help rather than leaving the issue unresolved.

2. Confirm updates across the team

Ask whoever manages your IT to identify staff using Authenticator on Android and verify their installed versions. Include personally owned phones where they are used for work access.

For managed devices, use the available app inventory and update controls to deploy and verify the fixed version. For unmanaged phones, give staff clear instructions and a way to confirm completion. Do not assume that automatic updates have already reached every device.

3. Be cautious about unfamiliar apps

Avoid installing apps from unsolicited links or unapproved sources. Keep Android itself updated and use supported devices.

Only install apps you need from trusted sources, but remember that a trusted store and a short permissions list do not guarantee an app is safe. If you notice an unfamiliar app or unusual account behaviour, report it to your IT team.

4. Investigate suspected compromise properly

If a phone has run a suspicious app, or the account shows unexpected activity, involve your IT or security provider. They can assess the device and review relevant Microsoft Entra sign-in and audit records, authentication methods and account activity.

Depending on the findings, the response may include isolating the device, preserving relevant evidence, removing malicious software, revoking sessions and refresh tokens, and removing unauthorised sign-in methods. Password changes may also be appropriate, but a password reset alone is not a complete response to stolen tokens or an attacker-added sign-in method.

Updating Authenticator prevents this vulnerable behaviour in the app. It does not automatically undo changes an attacker has already made to an account. Session revocation also needs to be assessed alongside token lifetimes and the services involved, rather than treated as an instant guarantee that every existing access token stops working.

Should you stop using Authenticator or turn off MFA?

No. Keep multi-factor authentication enabled and update the app.

MFA remains an important protection against stolen passwords. This vulnerability illustrates why the devices and apps supporting authentication also need maintenance; it does not make password-only sign-in a safer alternative.

Do not delete your work account from Authenticator or uninstall the app as a precaution without guidance. Doing so can interrupt access to work systems and may require your administrator to help you register again.

Phishing-resistant methods such as FIDO2 security keys can form part of a stronger sign-in strategy, particularly for privileged accounts. They are not a substitute for fixing a vulnerable app on a device that already has access to work accounts.

A message you can send to your team

If you use Microsoft Authenticator on an Android phone for work, please update it through the Google Play Store or our approved company app service. Check that the installed version is 6.2606.4246 or later. Keep MFA enabled and do not remove your work account from the app. If you cannot update it, see an unfamiliar app or notice unusual sign-in activity, contact our IT support team. Do not install fixes from links in unexpected messages.

The wider lesson for businesses

The phone used to approve a sign-in is part of your business's security boundary, even when it belongs to a member of staff. Clear ownership of updates matters just as much here as it does on laptops and servers.

A practical approach combines supported devices, prompt app updates, sensible installation rules and visibility of unusual account activity. It also gives staff a straightforward way to ask for help when something does not look right.

ITfinity can help you review how your team accesses Microsoft 365 and identify practical steps to strengthen protection. Talk to us about your current setup or explore our cyber security services.

Sources and further reading

• Microsoft Security Response Center: CVE-2026-80097. Official advisory released 8 September 2026 and shown as updated 15 September 2026; includes the severity, exploitability assessment and attack prerequisites.
• Enclave: AuthMask research. Original research by Ofek Levin, published 23 October 2026; describes the demonstrated impact and fixed version.
• Help Net Security: Microsoft Authenticator vulnerability let rogue Android apps steal work account access. Reporting published 27 October 2026.

Information checked on 28 October 2026. Security guidance can change; refer to Microsoft's current advisory and the latest app release when acting.