CVE-2026-97785
Microsoft: authentication bypass
- Risk score
- 80/100
- CVSS
- 10.0 v3.1
- Exploit chance (30 days)
- 0.6%
- Published
- 22 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- AAD App Proxy has a flaw in its authentication, allowing an attacker to elevate privileges over a network without logging in. An attacker could use this to gain high privileges.
- Affected
- {'vendor': 'microsoft', 'product': None, 'packages': []}
- Fix
- Check the linked advisory for details on the fix.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 10.0 critical
- Remotely exploitable without logging in
- Named in a government or vendor bulletin
Government and vendor bulletins
References
Original description
Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.
Last activity 22 Oct 2026. Patch Forecast updates every hour.