Patch Forecast
Amber warning
Patch this week.

CVE-2026-97785

Microsoft: authentication bypass

Risk score
80/100
CVSS
10.0 v3.1
Exploit chance (30 days)
0.6%
Published
22 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
AAD App Proxy has a flaw in its authentication, allowing an attacker to elevate privileges over a network without logging in. An attacker could use this to gain high privileges.
Affected
{'vendor': 'microsoft', 'product': None, 'packages': []}
Fix
Check the linked advisory for details on the fix.
Exploitation
No known exploitation

Why it is Amber

  • CVSS 10.0 critical
  • Remotely exploitable without logging in
  • Named in a government or vendor bulletin

Government and vendor bulletins

References

Original description

Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.

Last activity 22 Oct 2026. Patch Forecast updates every hour.