The vulnerability is an improper authentication flaw in Microsoft Entra application proxy that allows an unauthorized attacker to elevate privileges over a network. Because the flaw bypasses normal authentication checks, an attacker can gain access to privileged functions normally reserved for authenticated users. This represents a high impact security risk, exemplified by the CWE-287 identifier that indicates Authentication Bypass.

The affected product is Microsoft Entra application proxy, as defined by the CNA. No specific version information is provided in the data; users should consult the Microsoft Security Response Center advisory for detailed version guidance.

The CVSS score of 10 underscores the severity of the vulnerability, and the EPSS score is not available at this time, so the current probability of exploitation is unknown. The vulnerability is not listed in the CISA KeV catalog. The likely attack vector is remote over the network, inferred from the fact that the flaw pertains to authentication in a network-facing service. Because the flaw allows elevation of privileges without prior authentication, exploitation could occur by any attacker who can reach the application proxy endpoint, potentially enabling further lateral movement or privileged data access.