CVE-2026-97785 is an improper authentication flaw in Microsoft Entra application proxy (AAD App Proxy). An unauthenticated attacker can exploit it over the network to elevate privileges, and it carries a CVSS 3.1 base score of 10.0 (Critical).
What Is It
Microsoft describes the issue as "improper authentication in AAD App Proxy" that "allows an unauthorized attacker to elevate privileges over a network." It is classified as CWE-287 (Improper Authentication).
Microsoft ([email protected]) published the record on 2026-10-22. NVD lists its status as "Received," so NVD has not finished its own analysis yet.
Why It Matters
The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. In plain terms:
- Network attack vector, low complexity: the attacker can reach it remotely without special conditions.
- No privileges or user interaction required: the attacker needs no account and no one has to be tricked.
- Scope changed: a successful attack can affect resources beyond the vulnerable component.
- High confidentiality and integrity impact, with no availability impact.
The exploitability subscore is 3.9 and the impact subscore is 5.8. The exploitability subscore of 3.9 is the highest possible value under CVSS 3.1. It reflects network access, low attack complexity, and no required privileges or user interaction.
Exploitation status: No CISA KEV entry was supplied for this CVE. The source data does not confirm active exploitation.
What's Vulnerable
- Vendor: Microsoft
- Product: Microsoft Entra application proxy (called "AAD App Proxy" in the description)
- Versions: listed as "-" with status "affected," meaning no specific version range is given
Microsoft tagged the CVE as "exclusively-hosted-service," which marks Entra application proxy as a service Microsoft hosts. The record lists no specific CPEs.
Patch Status
The supplied NVD record has no patch, fix version or required-action details. Because there is no KEV entry, no CISA remediation deadline or required action applies.
The "exclusively-hosted-service" tag means the product is a Microsoft-hosted service. The record itself does not say whether Microsoft has already fixed it on the service side or whether customers need to do anything. Organizations using Entra application proxy should check the Microsoft Security Response Center (MSRC) advisory for official remediation guidance and any customer actions.