This vulnerability in Microsoft Authenticator for Android (version 6.0.0) involves the exposure of sensitive information to unauthorized actors over a network. It is identified as CWE-200, meaning sensitive data is disclosed without proper authorization. The CVSS v3.1 base score is 9.6, reflecting critical severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. Microsoft has published an official fix to remediate this vulnerability.

An attacker without privileges can exploit this vulnerability remotely over a network, potentially causing complete compromise of confidentiality, integrity, and availability of the affected system. Sensitive information handled by Microsoft Authenticator for Android 6.0.0 may be disclosed to unauthorized actors, leading to significant security risks.

An official fix is available from Microsoft. Users and administrators should apply the update to Microsoft Authenticator for Android to remediate this vulnerability. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41615 for detailed patching instructions.