CVE-2026-97785: AAD App Proxy Elevation of Privilege Vulnerability

Published Oct 22, 2026

Updated

AAD App Proxy Elevation of Privilege Vulnerability

Other sources

Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.

— Microsoft

Affected Software

2 affected components

Microsoft Azure AD Application Proxy

Microsoft Entra application proxy

Event History

Oct 22, 2026

CVE Published

via Microsoft·02:00 PM

Data Sourced

via Microsoft·02:00 PM

DescriptionSeverityWeaknessAffected Software

CVE Published

via MITRE·09:44 PM

Data Sourced

via MITRE·09:44 PM

DescriptionSeverity

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The vector is network-based, with low attack complexity. No privileges or user interaction are required.

Which environments should be considered exposed?

Deployments of Microsoft Azure AD Application Proxy or Microsoft Entra application proxy should be evaluated.

What security impact is indicated by the available assessment?

The assessment indicates high confidentiality and integrity impact, with no availability impact. Its scope is changed, meaning the impact can extend beyond the vulnerable component's security authority.

CVE-2026-97785: AAD App Proxy Elevation of Privilege Vulnerability

Other sources

Affected Software

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which environments should be considered exposed?

What security impact is indicated by the available assessment?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which environments should be considered exposed?

What security impact is indicated by the available assessment?