Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.
Critical 10.0
CVE-2026-97785
Microsoft Entra application proxy — authentication bypass.
Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.
WeaknessCWE-287: Authentication bypass
Published Updated Source NVD
CVSS 3.1
10.0
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Exploit chance, 30 days
0.6%
Higher than 50% of all CVEs (EPSS)
Status
No known exploitation
Not in CISA KEV
Patch
Unknown
Check the vendor advisory
What happened
What to do
- 01Check whether you run Microsoft Entra application proxy, and which version.
- 02Follow the vendor advisory for a fix or a workaround.
References
Timeline · UTC
- Published to NVD
- NVD record updated
Also actively exploited
Other CVEs from Microsoft
40+ more CVEs, 1 actively exploited
8.8Microsoft Windows — Command Injection.ExploitedEPSS 9.8%10.0Microsoft Azure Kubernetes Configuration Service — missing authentication.EPSS 0.7%10.0Microsoft VM Inspector for Azure Virtual Machines — Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual…EPSS 0.9%9.1Microsoft Azure Pipelines — command injection.EPSS 0.7%9.6Microsoft Visual Studio Code — path traversal.EPSS 0.8%9.8Microsoft Windows 10 1809 — use-after-free.EPSS 1.0%