CVE-2026-97785 AAD App Proxy Elevation of Privilege Vulnerability
Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.
Continuous enterprise threat intelligence tracking active in-the-wild zero-days (CISA KEV), Microsoft Windows KB cumulative updates, MSRC security advisories, and CVE remediation.
Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.
Corrected Fixed Build Number and Download links in the Security Updates table. This is an informational change only.
Corrected Fixed Build Number and Download links in the Security Updates table. This is an informational change only.
Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.
Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.
Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network.
Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network.
Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network.
The vulnerability associated with this CVE was fixed in July, however was inadvertently not included with that release. Microsoft recommends updating to the most current release of the SharePoint server.
Updated an acknowledgement. This is an informational change only.
Updated an acknowledgement. This is an informational change only.
Updated an acknowledgement. This is an informational change only.
Updated an acknowledgement. This is an informational change only.
Updated an acknowledgement. This is an informational change only.
Updated an acknowledgement. This is an informational change only.
Updated an acknowledgement. This is an informational change only.
Updated an acknowledgement. This is an informational change only.
Updated an acknowledgement. This is an informational change only.
Updated an acknowledgement. This is an informational change only.
Updated CVE to relect that this vulnerability is in the Windows Subsystem for Linux product. Microsoft recommends that customer using this product should install the latest version to be protected.
Updated the Security Updates table to list Microsoft Identity Web v3 and v4 separately and clarify the affected version ranges. The existing security updates are versions 3.16.0 and 4.16.1, respectively. This is an informational change only.
Updated an acknowledgement. This is an informational change only.
Updated an acknowledgement. This is an informational change only.
Updated the Security Updates table to add download and KB article links for Microsoft Visual Studio. This is an informational change only; the fixed builds are unchanged.