Authenticator containment and token-revocation thresholds

The cited analysis provides actionable escalation thresholds for CVE-2026-80097: patch Microsoft Authenticator for Android and preserve identity telemetry before an incident determination is needed; quarantine and revoke sessions and refresh tokens when suspicious applications or anomalous token activity provide evidence of possible exploitation; and classify confirmed theft or unauthorized access as account compromise.

Acting now preserves the Microsoft Entra evidence needed to distinguish vulnerable deployment from actual exposure.

The analysis was recorded on 2026-10-27, but the historical replay cutoff is 2026-10-27T12:18:49.431+00:00 and no direct vendor release evidence validates 6.2606.4246, so the immediate version instruction must remain tied to the vendor-designated fixed release rather than an unverified exact threshold.

Four groups face distinct consequences.

First, people using Microsoft Authenticator for Android clients implicated by CVE-2026-80097—including installations reported as 6.2606.4246—need a vendor-designated fixed release, but installation alone does not prove token theft.

Second, people whose Android device also hosted a suspicious application face possible exploitation and require device quarantine plus revocation of sessions and refresh tokens.

Third, identities showing anomalous bearer-token or refresh-token activity, including anomalous Microsoft Entra activity, require revocation and investigation of downstream resource access. Fourth, accounts with confirmed token theft or unauthorized access must be handled as compromised.

Mobile-device administrators, identity teams, and security operations teams must perform the inventory, telemetry retention, containment, revocation, and investigation. The packet does not identify configuration-specific exposure or device-eligibility boundaries.

1) The cited identity-response analysis has a supporting stance: it describes a tiered response of patching and retaining identity telemetry, escalating to device quarantine and session and refresh-token revocation when suspicious applications or anomalous token activity appear, and treating confirmed theft or unauthorized access as account compromise.

It also states that vulnerable-version use alone does not prove theft.

2) The decision scout’s operational synthesis has a supporting stance: it connects Microsoft Authenticator for Android, CVE-2026-80097, bearer and refresh tokens, and downstream Microsoft Entra activity to concrete escalation thresholds.

3) The first evidence audit has a supporting stance: it confirms that the cited material supports patching, telemetry retention, evidence-triggered quarantine and revocation, and account-compromise handling.

4) The second evidence audit has an evidence-gap stance: it finds no direct vendor advisory, release note, or vulnerability record supporting 6.2606.4246 as the exact fixed-release threshold.

The exact-version claim therefore does not support the decision and has been replaced with the vendor-designated fixed release.

The decision scout framed the question around evidence thresholds for containing Microsoft Authenticator for Android devices implicated by CVE-2026-80097.

It proposed patching and telemetry retention for vulnerable-client use, quarantine and token revocation when a suspicious application coexisted or token activity became anomalous, and account-compromise handling after confirmed token theft or unauthorized access.

The linker found no prior decision suitable for reuse. One evidence review supported that tiered response but found no direct vendor advisory or release note proving that 6.2606.4246 is the fixed-version threshold. The boundary reviewer therefore required the version instruction to be qualified.

The arbiter resolved the issue by selecting the operational response while replacing the unsupported exact-version claim with “vendor-designated fixed release.” The available attribution excerpt discusses Cloudflare Workers AI and GLM-5.3 between August 27 and September 9, 2026, rather than Microsoft Authenticator, so it did not resolve the vendor-evidence gap.