{"id":"CVE-2026-97785","published":"2026-10-22T22:20:13.483","lastModified":"2026-10-26T11:16:39.473","description":"Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","cwes":["CWE-287"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97785","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The CVE describes an improper authentication flaw (CWE-287) in Azure AD Application Proxy that allows an unauthenticated, remote attacker to elevate privileges without user interaction.","exploitability":"Exploitation is highly likely due to network accessibility (AV:N), low attack complexity (AC:L), no required privileges (PR:N), and no user interaction needed (UI:N).","blast_radius":"Successful exploitation could lead to full compromise of confidentiality and integrity across the affected Azure AD tenant, potentially enabling lateral movement or persistent access for attackers.","remediation":"Upgrade to Azure AD Application Proxy patch level released on or after [Vendor Fix Date], or apply Microsoft Security Advisory MS26-97785 if available; until then, restrict external access to App Proxy endpoints and enforce conditional access policies requiring MFA for all administrative roles.","detection":"Monitor Azure AD sign-in logs for anomalous authentication events from high-risk IPs or unusual geographic locations targeting privileged accounts; look for repeated failed authentication attempts followed by successful privilege elevation in the same session.","tags":["auth-bypass","privilege-escalation","cloud","aad","cwe287"],"model":"garnet-coder","analyzedAt":"2026-10-24T08:48:57.006Z"}}