Affected Systems
Microsoft Authenticator for Android versions prior to 6.2606.4246. Affects work accounts signed into the app; personal accounts not impacted. Exploitation requires a malicious app installed on the same Android device.
Exploitation Status
No active exploitation observed. Microsoft rates exploitation as "less likely." Not listed in CISA KEV catalog as of October 26, 2026. Proof-of-concept demonstrated by Enclave Security. Patched September 2026.
Business Impact
A malicious Android app with no special permissions could impersonate legitimate Microsoft apps (Teams, Outlook) and obtain OAuth tokens for work accounts. Tokens grant access to email, files, and calendars via Microsoft Graph. Requires victim to have Authenticator installed with a signed-in work account and (per Microsoft) complete an authentication flow. Enclave researchers claim no user interaction was needed beyond having a signed-in account. Unclear if existing stolen tokens are revoked upon patching.
Urgency
🟠Within 24 hours
Recommended Actions
- Update Microsoft Authenticator for Android to version 6.2606.4246 or later immediately on all corporate devices.
- Push minimum version requirement (6.2606.4246) via mobile device management (MDM) platforms for managed Android devices.
- Review Azure AD/Entra ID sign-in logs for anomalous token issuance or Graph API access from Android devices between app installation and patch deployment.
- Educate users to avoid sideloading apps or installing apps from untrusted sources on devices with work accounts.
- Consider revoking and reissuing tokens for high-privilege accounts that used Authenticator on Android prior to patching, given uncertainty about token invalidation.