Vulnerability · NVD

CVE-2026-26123

MEDIUM 5.5 Published on 2026-03-10

Cwe is not in rca categories in Microsoft Authenticator allows an unauthorized attacker to disclose information locally.

Attack vector : Local No privileges required

Show raw CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS 0.60% exploit very unlikely percentile 45.7%

Tracked apps referencing this CVE

For each app: the affected range, the fixing version, and where the tracked app stands today.

Microsoft Authenticator iOS com.microsoft.azureauthenticator

Affected <6.8.40 Fixed in 6.8.40 Latest tracked 6.8.52 patched
Microsoft Authenticator Android com.azure.authenticator

Affected <6.2511.7533 Fixed in 6.2511.7533 Latest tracked 6.2607.4697 patched

Vulnerable CPE configurations (2)

Vendor	Product	Platform	Versions	CPE 2.3 URI
microsoft	authenticator iOS	iOS	<6.8.40	cpe:2.3:a:microsoft:authenticator::::::iphone_os::*
microsoft	authenticator Android	Android	<6.2511.7533	cpe:2.3:a:microsoft:authenticator::::::android::*