CVE-2026-97785

CriticalCVSS 10.0/10Last modified Oct 23, 2026

Description

Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-287

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 22, 2026
Last modified
Oct 23, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-977877.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Container Isolation FS Filter Driver CVE-2026-977887.5Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a networCVE-2026-977897.5Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.CVE-2026-97797.2ATEN Unizon doCryptoHugeFileToFile Improper Verification of Cryptographic Signature Remote Code Execution Vulnerability. This vulnerability CVE-2026-977905.5Improper link resolution before file access ('link following') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authoCVE-2026-977917.5In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. TCVE-2026-977927.8Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges loCVE-2026-977937.0Missing authentication for critical function in Windows Setup and Deployment allows an authorized attacker to elevate privileges locally.CVE-2026-977947.8Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privilegesCVE-2026-977987.8Improper neutralization of argument delimiters in a command ('argument injection') in Windows Error Reporting allows an authorized attacker CVE-2026-977997.8Improper verification of cryptographic signature in Windows Audio Service allows an authorized attacker to elevate privileges locally.CVE-2026-97808.8Quest NetVault Backup addclient3 Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to byp
CVE-2026-97785: Critical severity, CVSS 10.0 | Vulnix