CRITICAL 9.6 Published on 2026-05-14

CVE-2026-41615

Exposure of sensitive information to an unauthorized actor in Microsoft Authenticator allows an unauthorized attacker to disclose information over a network.

Attack vector : Network No privileges required

Show raw CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected tracked apps

Microsoft Authenticator

com.microsoft.azureauthenticator

No open vuln.

Microsoft Authenticator

com.azure.authenticator

No open vuln.

Vulnerable CPE configurations

Vendor	Product	Platform	Versions	CPE 2.3 URI
microsoft	authenticator iOS	iOS	<6.8.47	cpe:2.3:a:microsoft:authenticator::::::iphone_os::*
microsoft	authenticator Android	Android	<6.2605.2973	cpe:2.3:a:microsoft:authenticator::::::android::*

View on NVD ↗