{"id":"CVE-2026-97785","kind":"vulnerability","aliases":["CVE-2026-97785"],"related":[],"title":"Microsoft Entra App Proxy: flawed authentication lets an outsider gain higher privileges","description":"Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.","summary":"Microsoft Entra application proxy has an improper authentication flaw that lets an unauthorized attacker over the network elevate privileges. Microsoft fixed it on its cloud service, so customers have no action to take.","severity":"critical","cvss":10.0,"epss":0.00598,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft Entra application proxy","fixed":["service-side, no customer action"],"affected":"unknown (cloud service, no versions published)","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["azure-ad-app-proxy","cloud-service","microsoft-entra","vendor"],"not_affected_if":["no-entra-app-proxy"],"how_to_check":null,"fix":"No customer action: Microsoft fixed the flaw service-side. Confirm the status in the Microsoft advisory for CVE-2026-97785.","status":"resolved","published_at":"2026-10-22T22:20:13+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:31:38+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T22:31:38Z","model":"claude-haiku-5-5","output":{"fix":"No customer action: Microsoft fixed the flaw service-side. Confirm the status in the Microsoft advisory for CVE-2026-97785.","reach":"network","title":"Microsoft Entra App Proxy: flawed authentication lets an outsider gain higher privileges","impact":"high","summary":"Microsoft Entra application proxy has an improper authentication flaw that lets an unauthorized attacker over the network elevate privileges. Microsoft fixed it on its cloud service, so customers have no action to take.","category":"vendor","who_cares":["microsoft-entra","azure-ad-app-proxy"],"confidence":0.6,"needs_auth":"unknown","worst_case":"unauthorized network attacker gains elevated privileges on the service","analyst_note":"Confirm the fix and affected scope in the Microsoft Security Response Center entry for CVE-2026-97785; sources list no versions or auth details.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-entra-app-proxy"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00049,"input_tokens":2922,"output_tokens":396,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the Microsoft MSRC advisory for CVE-2026-97785 (https://nvd.nist.gov/vuln/detail/CVE-2026-97785 links to it) for affected components, patch or service-side status, and mitigation steps.","search":"'-2026':14A,17A '-97785':15A,18A 'aad':71C 'action':65B 'ad':25B 'allow':74C 'app':3A,26B,72C 'applic':37B 'application':21A 'attack':48B,77C 'authent':6A,42B,69C 'azur':24B 'azure-ad-app-proxi':23B 'cloud':29B,59B 'cloud-servic':28B 'custom':62B 'cve':13A,16A 'elev':52B,79C 'entra':2A,20A,33B,36B 'fix':55B 'flaw':5A,43B 'gain':10A 'higher':11A 'improp':41B,68C 'let':7A,45B 'microsoft':1A,19A,32B,35B,54B 'microsoft-entra':31B 'network':51B,83C 'outsid':9A 'privileg':12A,53B,80C 'proxi':4A,27B,38B,73C 'proxy':22A 'servic':30B,60B 'take':67B 'unauthor':47B,76C 'vendor':34B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T22:20:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97785","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97785","severity":null,"published_at":"2026-10-22T22:20:13+00:00","modified_at":"2026-10-23T19:43:46+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-97785:145","url":null,"severity":null,"published_at":"2026-10-23T21:59:31+00:00","modified_at":"2026-10-23T21:59:31+00:00","first_seen_at":"2026-10-23T21:59:31+00:00","fetched_at":"2026-10-23T21:59:31+00:00","note":"MSRC advisory read: cloud service CVE, already mitigated by Microsoft, no action, exploited No, publicly disclosed No (exploit maturity Unproven). Did not search social; CVE is 1 day old and mitigation is complete. Critical severity kept as the vendor's rating, but real urgency is low."},{"source":"epss","external_id":"CVE-2026-97785","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97785","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1252,"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97785","title":"MSRC: AAD App Proxy Elevation of Privilege Vulnerability (CVE-2026-97785)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1253,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97785","title":"NVD CVE-2026-97785","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}