5.5 MediumCWE-939
CVE-2026-26123
Microsoft Authenticator Information Disclosure Vulnerability
MicrosoftMicrosoft Authenticator for Android
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 25 Oct
0.6%probability of exploitation in the next 30 days
Higher than 46% of scored CVEs
SeverityCVSS
5.5Medium
Description NVD
Cwe is not in rca categories in Microsoft Authenticator allows an unauthorized attacker to disclose information locally.
Coverage 3 articles · 2 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Tue 10 Mar · 22:03 UTC | Rapid7 | Patch Tuesday - March 2026 |
| Thu 12 Mar · 11:08 UTC | Malwarebytes | Microsoft Authenticator could leak login codes—update your app now |
| Wed 25 Mar · 10:43 UTC | Malwarebytes | Meet Khaled Mohamed: the bug hunter who found a Microsoft flaw |
- Meet Khaled Mohamed: the bug hunter who found a Microsoft flawMalwarebytes
- Microsoft Authenticator could leak login codes—update your app nowMalwarebytes
- Patch Tuesday - March 2026Rapid7 · first in our coverage · mentions it in passing