CVE-2026-97785criticalCWE-287

CVE-2026-97785: critical vulnerability in Microsoft Entra application proxy

AAD App Proxy Elevation of Privilege Vulnerability

Published 22 Oct 2026

25Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 10

exploitation probability

—

observed exploitation

nono source reports it

Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C

Affected products

References