Update Microsoft Authenticator on Android for CVE-2026-80097

If Microsoft Authenticator is on your Android phone, check the version today. Microsoft tracks CVE-2026-80097 as an elevation of privilege bug in Authenticator for Android and fixed it in version 6.2606.4246. Microsoft published the fix on September 8, 2026, but plain-language write-ups only arrived in late October: researcher Ofek Levin’s AuthMask post at Enclave and The Hacker News coverage on October 27.

Authenticator is a normal phone app. You update it the same way you update Maps or your bank app.

What Microsoft says the bug is

Microsoft’s Security Update Guide entry for CVE-2026-80097 describes improper authentication in Microsoft Authenticator that allows an unauthorized attacker to elevate privileges locally. Impact: elevation of privilege. Severity: Important. CVSS 3.1 base score: 8.6.

Microsoft’s FAQ on that page says a successful attacker could potentially authenticate against a remote host using the current user’s credentials. Microsoft says exploitation works like this:

1. A malicious app is installed and running on the affected Android device.
2. The user is convinced to complete an authentication flow in Microsoft Authenticator.
3. The attacker can then obtain authentication tokens and access resources as that user.

Microsoft lists the bug as not publicly disclosed and not exploited, with an exploitability rating of Exploitation Less Likely. The CVE was published September 8, 2026, as part of that month’s Patch Tuesday. A September 15 revision corrected the fix build number.

The CVE record lists Microsoft Authenticator for Android from version 6.0.0 up to, but not including, 6.2606.4246 as affected.

What the researchers showed

On Android, Authenticator does more than show six-digit codes. It also works as a sign-in broker: when Teams, Outlook, or another Microsoft app needs to sign you in to a work or school account, it asks Authenticator, and Authenticator hands back a token that proves you are signed in.

Enclave found that an app with no Android permissions at all could open a part of Authenticator that any app can start, claim to be an installed Microsoft app such as Teams, and get that app’s tokens back. Authenticator checked that the claimed app was real and installed, but never checked that the app actually asking was that app. In Enclave’s tests, posing as Teams and asking for Microsoft Graph tokens returned permissions to read and send mail, read and write files, and read and write calendars for the work account signed in to Authenticator. The Hacker News notes the tokens apply to that work account, not to other accounts.

Microsoft and Enclave disagree on how much you would have to do. Microsoft’s advisory and CVSS score say exploitation needs user interaction (completing a sign-in step in Authenticator). Enclave says its proof of concept got tokens with no interaction beyond having a signed-in work account on the phone. Either way, the answer is the same: update the app.

Do not install random “Authenticator test” apps to see if you are vulnerable. Install the fixed version from Google Play instead.

Who should care at home

• Anyone with a work or school account signed in to Microsoft Authenticator on Android, which is the setup the researchers attacked
• Anyone who also has Teams, Outlook, or OneDrive on the same phone for that account
• Everyone else who uses Authenticator on Android for a personal Microsoft account or as a code app for other logins: the published attack targeted work accounts, but the update is free and takes a minute

If you only use Authenticator on iPhone, this CVE is about the Android app. Keep the iPhone app updated through the App Store anyway.

How to update and check on Android

1. Open the Google Play Store on the phone that runs Authenticator.
2. Search for Microsoft Authenticator (from Microsoft Corporation), or find it in your list of installed apps. Official listing: Microsoft Authenticator on Google Play.
3. Tap Update if Play offers it. If it only says Open, Play thinks you are current; check the version anyway.
4. Open Authenticator once so the new version actually starts.
5. Check the version. In the Play listing, tap About this app and look at the version line, or go to your phone’s Settings > Apps > Authenticator and scroll down. You want 6.2606.4246 or newer. At the time of writing, Play lists 6.2609.6214.

If Play is stuck, switch to a reliable network and try again. Use Play, not app files from random websites.

After you update

• Microsoft’s advisory does not say whether updating cancels tokens a malicious app may already have obtained, and The Hacker News points out that gap. If you had apps you do not recognize installed, or you saw Authenticator prompts you did not start, remove the unknown apps, update Authenticator, then review recent sign-in activity for the account and change the password if anything looks wrong. For a work or school account, tell whoever runs that account.
• Keep Google Play Protect on. This bug needed a malicious app on the phone, so avoiding mystery apps is still half the defense.
• Updating Authenticator does not update Windows, Chrome, or your iPhone. Different devices, different update buttons. For this month’s Windows updates, see our Windows October 2026 Patch Tuesday note.

Do this / don’t do that

Do

• Update Microsoft Authenticator on Android to 6.2606.4246 or later and confirm the version.
• Remove Android apps you do not recognize, especially anything installed from outside Google Play.
• Treat unexpected Authenticator prompts as suspicious until you know which app triggered them.

Don’t

• Don’t ignore Play’s Authenticator update because “I only use it for codes.” On Android it can also hand out sign-in tokens to other Microsoft apps.
• Don’t download Authenticator from third-party sites to “get the fix faster.”
• Don’t assume an iPhone Authenticator update covered your Android phone, or the other way around.
• Don’t try proof-of-concept tools from security blogs on the phone you use for banking and mail.

Bottom line

CVE-2026-80097 is fixed in Microsoft Authenticator for Android 6.2606.4246 (Microsoft advisory, CVE record). Microsoft rates it Important (CVSS 8.6), says it has not been exploited, and says an attack needs a malicious app on the phone plus completing a sign-in step in Authenticator. Researchers showed how an app with no permissions could pose as Teams and collect tokens for the work account signed in to Authenticator (Enclave AuthMask, The Hacker News). On your Android phone: open Google Play, update Authenticator, open it once, and confirm the version is 6.2606.4246 or newer. That is the whole job.

Image: Official Microsoft Authenticator page hero photo of a person using a phone (microsoft.com/security).