Microsoft Entra application proxy vulnerabilities

Latest Microsoft Entra application proxy CVEs

Newest publication first

1. CVE-2026-97785 AAD App Proxy Elevation of Privilege Vulnerability

   Published 2026-10-22

   Critical·CVSS 10.0 EPSS 0.65%

   Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.