CVE-2026-41615— Microsoft Authenticator Information Disclosure Vulnerability
Possible ATT&CK Techniques 1AI
T1530 · Data from Cloud StorageAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Microsoft | Microsoft Authenticator for Android | 6.0.0< 6.2605.2973 | affected |
| Microsoft | Microsoft Authenticator for IOS | 6.0.0< 6.8.47 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-41615
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Microsoft Authenticator Information Disclosure Vulnerability
Source: NVD (National Vulnerability Database)
Vulnerability Description
Exposure of sensitive information to an unauthorized actor in Microsoft Authenticator allows an unauthorized attacker to disclose information over a network.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
信息暴露
Source: NVD (National Vulnerability Database)
Vulnerability Title
Microsoft Authenticator 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Microsoft Authenticator是美国微软（Microsoft）公司的一款用于多因素身份验证（MFA）的应用程序。 Microsoft Authenticator存在信息泄露漏洞，该漏洞源于敏感信息泄露给未授权参与者，可能导致未经授权的攻击者通过网络泄露信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Microsoft | Microsoft Authenticator for Android | 6.0.0 ~ 6.2605.2973 | - | |
| Microsoft | Microsoft Authenticator for IOS | 6.0.0 ~ 6.8.47 | - |
II. Public POCs for CVE-2026-41615
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-41615
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-41615 (1)
Same Patch Batch · Microsoft · 2026-05-14 · 3 CVEs total
| CVE-2026-42897 | 8.1 HIGH | Microsoft Exchange Server Spoofing Vulnerability |
| CVE-2026-44503 | Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host |
IV. Related Vulnerabilities
Same vendor: Microsoft
- CVE-2026-46538
Microsoft UFO accepts cross-device TASK_END messages by sess - CVE-2026-46416
Microsoft UFO shared WebSocket handler state causes cross-cl - CVE-2026-46414
Microsoft UFO WebSocket role spoofing allows authenticated p - CVE-2026-46402
Microsoft UFO uses untrusted task_name in log paths, allowin - CVE-2026-46544
Microsoft UFO reuses client-supplied WebSocket session IDs a
Same weakness: CWE-200
- CVE-2026-2128
Breeze Cache <= 2.5.2 - Unauthenticated Exposure of Sensitiv - CVE-2026-8995
Poll Maker by AYS <= 6.3.7 - Authenticated (Subscriber+) Sen - CVE-2026-47136
RustFS: Unauthenticated RustFS console license endpoint expo - CVE-2026-45332
Automad Broken Access Control: unauthenticated exposure of a - CVE-2026-7526
PDF Embedder <= 4.9.3 - Authenticated (Contributor+) Informa
V. Comments for CVE-2026-41615
No comments yet