Low Severity
CVE-2026-97785
Published: Oct 30, 2026
Offline Python applicability detector for CVE-2026-97785 in Microsoft Entra application proxy, with CSV/JSON inventories and auditable reports.
# CVE-2026-97785 service applicability detector
A Python command-line tool for identifying inventory records that explicitly name
**Microsoft Entra application proxy**, the hosted service associated with
CVE-2026-97785. It produces auditable local reports for service-owner review.
**Detection boundary:** this implementation detects inventory applicability. It
cannot determine whether Microsoft's currently deployed service is vulnerable,
verify a tenant's remediation, or detect exploitation. All findings explicitly
retain `vulnerability_status: unknown`. The tool never emits an affected,
unaffected, patched, or compromised verdict.
## Advisory basis and technical constraints
The Microsoft CNA record identifies improper authentication (CWE-287) in AAD App
Proxy and names Microsoft Entra application proxy as the affected product. The
record marks this issue as exclusively hosted and reports a CVSS v3.1 base score
of 10.0. Its affected-version value is a dash, not a customer-checkable release
interval. There is no defensible local patch threshold in the reviewed record.
The version placeholder is not interpreted as a minimum release or an indication
that every Entra tenant is currently vulnerable.
Primary references:
- [Microsoft Security Response Center advisory](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97785)
- [Microsoft-authored CVE Program record](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97785.json)
Rules were reviewed on **2026-10-28**. The retrieved CNA record snapshot reported
`dateUpdated: 2026-10-27T21:23:37.712Z`; a moving upstream URL may subsequently
contain newer information. The MSRC page requires JavaScript and its remediation
text was not available through the text retrieval used during development. This
project therefore does not assert a remediation date or customer patch action.
The bundled rules contain an authored extraction of relevant facts, not a copy
of the full record. Ch