CVE-2026-80097: The Authenticator App Is a Credential Store, Not Just a Prompt

Microsoft Authenticator was the control most organisations reached for once they moved past SMS codes. CVE-2026-80097 concerns improper authentication in that app, and it is worth reading carefully rather than filing under "mobile bug".

What the record says

NVD describes CVE-2026-80097 as improper authentication in Microsoft Authenticator allowing an unauthorized attacker to elevate privileges locally. The weakness is CWE-287, and the CVSS base score is 8.6. It was published on 8 September 2026, and Microsoft's update guide is the vendor reference.
The important qualifiers are "locally" and "elevate privileges". This is not a remote takeover of the vault. It is a flaw in the authentication logic of a component the organisation has designated as the thing that proves identity.

Why an authenticator app is not just a second factor

Microsoft Authenticator holds far more than one-time codes. It stores passwordless credentials, push notification registrations, account metadata for every identity the user has linked, and it acts as a broker for sign-ins through the Microsoft identity platform. On a shared or supervised device it can span multiple accounts.
The app's own authentication boundary is therefore a security control in its own right. If an attacker already has a foothold on the device, the question is whether reaching the app's internal state requires anything more than what that foothold provides. A local elevation in a credential-bearing app changes the answer, and it changes it for every account the app can act for.

The small, boring mitigations that work

Enforce device passcodes and biometrics on any device that holds an authenticator app, and require re-authentication at the OS level rather than inside the app alone. The app's own lock screen is a convenience feature; the platform lock is the control.
Keep number matching enabled rather than simple approve/deny. Number matching does not fix this flaw, but it is the control that removes the entire class of MFA fatigue attacks, and it costs nothing.
Limit how many accounts a single device holds. A personal phone carrying one corporate identity is a smaller blast radius than a tablet signed into six tenants.
Then check for rooted and jailbroken devices among the population that holds authenticator registrations. Local privilege escalation flaws are worth materially more on a device whose platform integrity is already broken.

Patch management for an app nobody counts

Mobile applications sit outside most software inventory, which is the awkward part. The practical approach is to use whatever device management is in place to report installed application versions on managed devices, and to close the gap by policy on unmanaged ones: require that the app be updated within a defined window, and treat out-of-date authenticator builds the same way as an unpatched VPN client.

References

• NVD record for CVE-2026-80097: https://nvd.nist.gov/vuln/detail/CVE-2026-80097
• Microsoft update guide entry: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80097