Microsoft Authenticator EUVD-2026-73327

Exploitation requires local access to an Android device running Microsoft Authenticator version 6.0.0 through below 16.3.0. The CVSS UI:R metric indicates that some form of user interaction is required - the exact nature (e.g., the victim must initiate an authentication flow, or the attacker must trigger a specific app state) is not specified in the available description. PR:N confirms no existing device account privileges are required for the attacker. Exploitation is limited to the Android platform; the iOS version is not referenced. Non-default conditions that narrow the attack surface: physical or local logical access to the target device is mandatory (AV:L); remote-only network attackers cannot reach this vulnerability directly.

The provided CVSS 8.6 vector (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) characterizes a locally-exploited, low-complexity attack requiring user interaction but no prior privileges, with high impact across confidentiality, integrity, and availability after a scope change. The combination of PR:N and AV:L is notable: it implies a local non-privileged actor (physical access or shared-device scenario) can trigger the bypass, which is realistic in shared-device enterprise environments, kiosk deployments, or via physical access attacks. The UI:R constraint limits opportunistic remote exploitation but does not block targeted attacks. EPSS data is not available in the provided intelligence. There is no KEV listing and no POC, so real-world exploitation probability is currently unconfirmed. The primary real-world risk is in enterprise environments where Microsoft Authenticator is mandated for Azure AD/Entra ID MFA - a bypass here could grant lateral movement or account takeover post-scope-change. The wide affected range (6.0.0 to <16.3.0) suggests significant installed-base exposure if device auto-updates are suppressed.

An attacker with physical access to an Android device, or operating via ADB on an unlocked developer device, triggers a local authentication bypass in Microsoft Authenticator before version 16.3.0 - circumventing the app's lock screen or biometric gate. With authentication bypassed, the attacker can access stored MFA tokens, approve pending authentication requests, or extract account credentials protected by the app, effectively compromising any Microsoft or federated account the victim's Authenticator is enrolled for. No public exploit code has been identified at time of analysis.