CVE-2026-80097 Overview
CVE-2026-80097 is an improper authentication vulnerability [CWE-287] in Microsoft Authenticator that enables local privilege escalation. An unauthorized attacker with local access can bypass authentication checks to elevate privileges on an affected system. Successful exploitation results in high impact to confidentiality, integrity, and availability, and involves a scope change per the CVSS vector. Exploitation requires user interaction, which typically means an attacker must convince a user to perform a specific action on the device.
Microsoft published the advisory through the Microsoft Security Response Center. No public proof-of-concept or in-the-wild exploitation has been reported at the time of writing.
Critical Impact
A local attacker who successfully exploits CVE-2026-80097 can bypass Microsoft Authenticator authentication controls and elevate privileges, potentially reaching resources outside the vulnerable component due to the scope change.
Affected Products
- Microsoft Authenticator (see the Microsoft advisory for CVE-2026-80097 for specific affected versions)
Discovery Timeline
- 2026-09-08 - CVE-2026-80097 published to the National Vulnerability Database
- 2026-09-09 - Last updated in the NVD database
Technical Details for CVE-2026-80097
Vulnerability Analysis
CVE-2026-80097 is classified under [CWE-287] Improper Authentication. Microsoft Authenticator fails to correctly validate authentication state before granting access to a privileged operation. An attacker with local access and the ability to induce user interaction can leverage this weakness to bypass identity assertions the application depends on.
The CVSS vector indicates the attack requires local access and low complexity, no attacker-side privileges, and user interaction. The scope change is notable: exploitation impacts resources beyond the vulnerable component's security authority. This typically maps to authentication tokens, session material, or protected credentials that Microsoft Authenticator issues or brokers to other components.
EPSS currently ranks the probability of near-term exploitation at 0.398% (33rd percentile), reflecting the absence of a known public exploit.
Root Cause
The root cause is improper authentication logic within Microsoft Authenticator. The application does not sufficiently verify the identity or authenticity of the caller before performing sensitive operations. This class of flaw commonly stems from missing verification steps, reliance on client-supplied trust indicators, or incorrect handling of authentication state during specific user-driven flows. Microsoft has not published the specific code-level defect.
Attack Vector
Exploitation requires local access to the target system and user interaction. A plausible scenario involves an attacker with a foothold on the device (for example, through a low-privilege user account or a malicious application) triggering an authentication workflow in Microsoft Authenticator and coercing the user into approving or completing an action. Because the CVSS scope is changed, the elevated privileges may extend to resources managed outside the Authenticator process, including brokered identity assertions.
No verified exploit code is publicly available. Refer to the Microsoft Security Response Center advisory for authoritative technical detail.
Detection Methods for CVE-2026-80097
Indicators of Compromise
- No vendor-published indicators of compromise are available for CVE-2026-80097 at this time.
- Review Microsoft Authenticator client logs and Entra ID sign-in logs for authentication events that do not correlate with legitimate user activity.
- Investigate unexpected privilege changes or token issuance events on endpoints where Microsoft Authenticator is installed.
Detection Strategies
- Monitor for abnormal local process activity that interacts with Microsoft Authenticator binaries or protected credential stores.
- Correlate endpoint telemetry with identity provider logs to surface authentication approvals that occur without corresponding user-driven push notifications.
- Baseline Microsoft Authenticator usage per user and alert on deviations, such as approvals originating from unfamiliar processes or automation.
Monitoring Recommendations
- Ingest Microsoft Authenticator and Entra ID sign-in logs into a centralized analytics platform for correlation with endpoint telemetry.
- Alert on newly elevated processes spawned in temporal proximity to Microsoft Authenticator interactions.
- Track version and patch state of Microsoft Authenticator across the fleet to identify unpatched instances.
How to Mitigate CVE-2026-80097
Immediate Actions Required
- Apply the update referenced in the Microsoft advisory for CVE-2026-80097 to all affected installations of Microsoft Authenticator.
- Inventory endpoints and mobile devices running Microsoft Authenticator and prioritize patching for privileged users and administrators.
- Educate users to reject unexpected authentication prompts, since exploitation requires user interaction.
Patch Information
Microsoft has published guidance for CVE-2026-80097 through the Microsoft Security Response Center. Consult the official MSRC entry for the specific fixed versions and deployment instructions applicable to your platform.
Workarounds
- No vendor-approved workaround has been published; installing the vendor update is the authoritative remediation.
- Restrict local access to endpoints running Microsoft Authenticator through least-privilege account policies and application allow-listing.
- Enforce conditional access policies in Entra ID to require compliant, patched devices for sensitive resource access.
# Example: query installed Microsoft Authenticator version on Windows to prioritize patching
Get-AppxPackage -Name *Authenticator* | Select-Object Name, Version, PackageFullName
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.