Do Staff Phones Need the Latest Microsoft Authenticator?
Updated: 11 hours ago
Short answer: Yes. If your team uses Microsoft Authenticator on Android, make sure the app is on version 6.2606.4246 or later. In September 2026, Microsoft fixed a flaw that could let a harmful app on the same phone steal a person's sign-in and get into their work account. Microsoft says nobody was known to be using it when the fix came out. The fix is simple: update the app from Google Play, and make sure every phone that signs in to work actually did.
What was wrong with Microsoft Authenticator on Android?
Authenticator is the app many people tap to approve a sign-in to their work email and files. The flaw (Microsoft tracks it as CVE-2026-80097) meant a bad app already sitting on the phone could grab the "you're signed in" pass that Authenticator hands out. With that pass, someone could get into the work account as that person.
There's a catch for the attacker: the harmful app has to get onto the phone first, and the person has to complete a sign-in in Authenticator. That's why the everyday habits below matter as much as the update.
Was anyone attacked with it?
Microsoft reported no known attacks and said the flaw hadn't been made public when it released the fix. Microsoft also rated it as less likely to be used. That's good news, but it's a snapshot from when the fix came out, not a promise. Old versions are still worth getting rid of.
How do staff check their Authenticator version?
On an Android phone:
Open the Google Play Store.
Search for Microsoft Authenticator and open it.
If you see Update, tap it. If you only see Open, you're already up to date.
While you're in the Play Store, it's worth making sure automatic app updates are turned on, so the next fix shows up without anyone having to remember.
Do personal phones count?
Yes. If someone uses their own phone to approve sign-ins to work, that phone is part of how your firm logs in. A lot of firms don't manage personal phones at all, so nobody pushes the update for them. A quick note to staff asking them to check is often the fastest way to cover those phones.
How does a company make sure every phone updated?
Company-managed phones: your device management tool can push app updates and, in many setups, require a minimum app version.
Personal phones: where your setup supports it, app protection rules can block work access from out-of-date apps. Where it doesn't, a short reminder to staff, plus a follow-up with anyone who isn't sure, goes a long way.
If you don't know which of those you have in place, that's a good question to ask your IT team.
What habits keep this kind of flaw from mattering?
Install apps only from the Google Play Store. Don't install apps from links or files someone sends you.
Leave automatic app updates on.
Only approve sign-ins you started yourself. If a prompt shows up out of nowhere, deny it and tell IT. (More on that in our posts on fake IT help desk calls and device code phishing.)
For admins and anyone who moves money, use the strongest sign-in method you have available.
The same caution applies to codes you scan. See our guide to QR code phishing.
How does 24uNet help?
Keeping phones and sign-in apps current is part of our Security Baseline. We also offer identity threat detection and response, which watches for signs that someone is using a stolen sign-in. For a related "is it actually updated?" question, see Are our office Macs still getting security updates?
FAQ
Which Authenticator version fixes CVE-2026-80097? Version 6.2606.4246 or later of Microsoft Authenticator for Android.
Was the flaw used in attacks? Microsoft reported no known attacks and no public disclosure when it released the fix.
Do iPhone users need to do anything? Microsoft's advisory lists the Android app. Keeping every app updated on any phone is still the right habit.
Is Microsoft Authenticator still safe to use? Yes, once it's updated. Approving sign-ins through an up-to-date app is far better than having no second step at all.
Do personal phones count? Yes, if they're used to sign in to work accounts.
Not sure every phone is covered?
If you'd like a second set of eyes on how your team signs in and keeps phones updated, reach out to us. We're happy to talk it through.
ABOUT THE AUTHOR
Dane Gray — Cofounder, 24uNet. 30+ years in IT and cybersecurity. Cyber AB Registered Practitioner, CompTIA Security+, CEH. Texas A&M '91. Dane Gray on LinkedIn.
Comments