EUVD-2026-73327
GHSA-wp3h-mh9h-f6cm
Severity by source
AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Local attack, no prior privileges, user interaction required; scope change justified as bypass propagates to MFA-protected downstream accounts with full CIA impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Microsoft Authenticator for Android (versions 6.0.0 through below 16.3.0) allows a local attacker without any prior privileges to bypass the app's authentication controls and elevate privileges on the device. The scope-changed CVSS vector (S:C) reflects that a successful bypass extends impact beyond the Authenticator app itself - potentially compromising MFA-protected accounts and downstream Microsoft or enterprise services. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local access to an Android device running Microsoft Authenticator version 6.0.0 through below 16.3.0. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 8.6 vector (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) characterizes a locally-exploited, low-complexity attack requiring user interaction but no prior privileges, with high impact across confidentiality, integrity, and availability after a scope change. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update Microsoft Authenticator for Android to version 16.3.0 or later, which represents the first version outside the confirmed vulnerable range per the EUVD affected-version data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all devices running Microsoft Authenticator versions 6.0.0 through 16.2.x using your mobile device management solution and notify affected users of the vulnerability and required update. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today