Microsoft Entra Application Proxy
Monthly
Improper authentication in Microsoft Entra Application Proxy (formerly AAD App Proxy) allows an unauthenticated, remote attacker to elevate privileges across a trust boundary, with the supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) scoring 10.0 - no privileges, no user interaction and low complexity, with high confidentiality and integrity impact and a scope change. Exposure is deployment-specific: the target organization must actually run Application Proxy to publish internal applications for remote access, and the proxy endpoint must be reachable by the attacker; organizations not using the service are not exposed to this flaw. Microsoft is the reporting party and a vendor patch is available per the MSRC update guide, and the vuln.today decision label is act_now; no public exploit code or confirmed active exploitation was identified in the supplied data, although the trigger conditions themselves are not described in the available sources.
Improper authentication in Microsoft Entra Application Proxy (formerly AAD App Proxy) allows an unauthenticated, remote attacker to elevate privileges across a trust boundary, with the supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) scoring 10.0 - no privileges, no user interaction and low complexity, with high confidentiality and integrity impact and a scope change. Exposure is deployment-specific: the target organization must actually run Application Proxy to publish internal applications for remote access, and the proxy endpoint must be reachable by the attacker; organizations not using the service are not exposed to this flaw. Microsoft is the reporting party and a vendor patch is available per the MSRC update guide, and the vuln.today decision label is act_now; no public exploit code or confirmed active exploitation was identified in the supplied data, although the trigger conditions themselves are not described in the available sources.