Microsoft Entra application proxy: Elevation of privilege via improper authentication

Summary

Microsoft Entra application proxy (formerly Azure AD Application Proxy) publishes on-premises web applications to remote users. Improper authentication (CWE-287) allows an unauthenticated attacker over the network to elevate privileges. Microsoft rates the flaw critical (CVSS 3.1 base score 10.0) and states that customers need to take no action. No exploitation or public proof of concept was found in the sources retrieved.

Affected

• Microsoft Entra application proxy (formerly Azure AD Application Proxy)
• Version scope per secondary tracker: all versions (not confirmed by Microsoft in the retrieved text)

Fixed in

Unknown. Microsoft states that no customer action is required, which suggests a service-side fix; no build numbers were retrieved.

Workaround

Unknown. No vendor workaround is documented.

Exploitation

• No known exploitation as of the sources retrieved.
• CISA SSVC: Exploitation none, Automatable yes, Technical Impact total.
• Microsoft temporal vector: E:U (exploit code maturity unproven), RC:C (report confidence confirmed).
• No public proof of concept found.

Our recommendation

• Follow Microsoft's MSRC advisory and confirm with Microsoft that the cloud service is fixed.
• Ensure Entra application proxy connector agents are up to date and that auto-update works.
• Enforce Conditional Access with MFA on all published applications.
• Review Entra sign-in and audit logs for unusual access, especially to privileged accounts, for the past weeks.
• Keep at least two connectors per connector group.
• Monitor the CISA KEV catalogue and vendor updates.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  mehmet-emir-eroglu/CVE-2026-97785

Research sources

• MSRC advisory CVE-2026-97785 msrc.microsoft.com
• MITRE/CVE record via threatint cve.threatint.com
• Microsoft Entra application proxy overview learn.microsoft.com
• Microsoft Entra application proxy security learn.microsoft.com
• Strix CVE-2026-97785 (secondary) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 13:55.