---
id: "CVE-2026-97785"
kind: "vulnerability"
aliases: ["CVE-2026-97785"]
title: "Microsoft Entra App Proxy: flawed authentication lets an outsider gain higher privileges"
severity: "critical"
cvss: 10.0
epss: 0.00598
exploited: false
status: "resolved"
category: "vendor"
products: [{"name": "Microsoft Entra application proxy", "fixed": ["service-side, no customer action"], "affected": "unknown (cloud service, no versions published)", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["azure-ad-app-proxy", "cloud-service", "microsoft-entra", "vendor"]
not_affected_if: ["no-entra-app-proxy"]
published_at: "2026-10-22T22:20:13+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97785", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:59:31+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-97785", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Microsoft Entra App Proxy: flawed authentication lets an outsider gain higher privileges

Microsoft Entra application proxy has an improper authentication flaw that lets an unauthorized attacker over the network elevate privileges. Microsoft fixed it on its cloud service, so customers have no action to take.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Entra application proxy affected unknown (cloud service, no versions published) fixed service-side, no customer action

## Fix

No customer action: Microsoft fixed the flaw service-side. Confirm the status in the Microsoft advisory for CVE-2026-97785.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-97785
- 2026-10-23T21:59:31+00:00 analyst — MSRC advisory read: cloud service CVE, already mitigated by Microsoft, no action, exploited No, publicly disclosed No (exploit maturity Unproven). Did not search social; CVE is 1 day old and mitigation is complete. Critical severity kept as the vendor's rating, but real urgency is low.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-97785

## Documents

- [advisory] MSRC: AAD App Proxy Elevation of Privilege Vulnerability (CVE-2026-97785) https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97785
- [mentions] NVD CVE-2026-97785 https://nvd.nist.gov/vuln/detail/CVE-2026-97785

## From the sources

Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_