Microsoft Entra Application Proxy: elevation of privilege via improper authentication (CVE-2026-97785)
Severity: critical · Patch status: patched · Since 2026-10-22 · CVE-2026-97785
Microsoft disclosed CVE-2026-97785, an improper-authentication flaw in Microsoft Entra Application Proxy, on 22 October 2026. An unauthenticated attacker could elevate privileges over the network against tenants that publish internal applications through Application Proxy, which is the common way to expose on-premises apps to remote users. Microsoft reports no exploitation and no public disclosure. The fix lands on the connector and service side rather than as a version you install in your own stack, so the practical work is confirming your connectors are current and reviewing what the proxy exposes.
What to do
- Confirm every Application Proxy connector group runs a current build (connectors auto-update by default; check any group where that was disabled)
- Review which applications are published through Application Proxy and remove any that no longer need external exposure
- Read connector and sign-in logs for anomalous or unauthenticated access patterns against published apps
- Keep the proxy on the shortest path to the identity controls you rely on: conditional access, MFA and least-privilege app roles
Sources
All live incidents on Threat Watch
