CVE-2026-97785: Privilege Escalation in Microsoft Entra App Proxy

CVE-2026-97785 is an improper authentication vulnerability in Microsoft Entra ID Application Proxy (formerly Azure AD App Proxy). An unauthenticated attacker can exploit this defect to escalate privileges across the network, accessing protected resources. It directly impacts all organizations relying on Entra ID for identity management, Single Sign-On, and access control to critical applications.

The CVSS score is 10.0 (maximum possible), with critical severity declared by the National Vulnerability Database. The vulnerability was published on October 22, 2026. On October 28, offline Python detection tools were publicly disclosed to assess applicability across enterprise inventories, indicating the security community is already developing structured detection and audit strategies for exposed organizations.

Immediately contact official Microsoft channels to verify patch availability and timeline. Review configuration of all Entra ID Application Proxy deployments and implement network access controls to limit exposure. Monitor Entra ID access logs for anomalous behavior. If an official patch is not yet available, coordinate temporary mitigation measures directly with Microsoft.