Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-97785

Improper authentication privilege elevation in AAD App Proxy

CVSS 3.1
10.0 critical
EPSS
—
Published
·
Modified
Analyze CVE-2026-97785 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

Improper authentication in Microsoft AAD App Proxy lets an unauthorized attacker elevate privileges over the network, with no account and no user interaction. Scope crosses the proxy boundary, so confidentiality and integrity of affected resources can be fully compromised; availability is not affected. Organizations that publish apps through AAD App Proxy are affected. Microsoft has not listed affected builds.

What to do: Apply Microsoft's update for CVE-2026-97785. No fixed version or workaround is stated.

ProductAffected
Microsoft AAD App Proxy—
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.

Weakness
CWE-287
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
NVD CVE.org GitHub PoCs EPSS (—)

In the news

0 stories

No ingested article mentions this CVE yet.