Entra Application Proxy EUVD-2026-108539

The limiting precondition is deployment-specific rather than configuration-toggle-specific: the target organization must actually be using Microsoft Entra Application Proxy (the connector-based service that publishes on-premises/internal applications for remote access), and the attacker must be able to reach that proxy endpoint over the network. Within that deployment, the CVSS vector indicates no further gating - PR:N/UI:N/AC:L means no authentication, no user interaction and low complexity against the service. The precise feature state, protocol or request that triggers the improper authentication is not described in the available sources, so beyond 'Application Proxy is in use and network-reachable' no additional configuration requirement can be confirmed. Organizations not using Entra Application Proxy are not exposed to this specific flaw.

All severity signals point the same direction: the supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) scores 10.0 - network-reachable, low attack complexity, no privileges and no user interaction, with a scope change and high confidentiality and integrity impact, consistent with an improper-authentication (CWE-287) privilege elevation in an identity broker. The vuln.today decision label is act_now, the product is core Microsoft identity infrastructure, and the fix is confirmed (RL:O, RC:C) and reported by Microsoft itself, so this is a genuine high priority rather than a high-CVSS-but-low-real-risk issue. That said, the exploitation-maturity metrics qualify the urgency: the input carries E:U (exploit code unproven), there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation at time of analysis - the priority is driven by severity and the criticality of the affected component, not by observed in-the-wild activity. No key signals conflict; the main gap is the absence of EPSS data, so the near-term exploitation probability cannot be quantified from the input.

A remote, unauthenticated attacker who can reach an organization's Microsoft Entra Application Proxy endpoint sends a request that abuses the improper authentication check to be treated as an authorized principal, elevating privileges across the trust boundary and reaching applications published through the proxy. Because the flaw requires no credentials, no user interaction and low complexity, exploitation is straightforward for any attacker with network access to the exposed service. No public exploit identified at time of analysis (exploit code is marked unproven), so this remains a theoretical chain rather than a demonstrated one.