CVE-2026-50338High· 8.2▾ MidnightPoC availableImproper authentication in Azure Spring Apps allows an authorized attacker to elevate privileges over a network.
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 45.1 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Sep 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.5%
Last analysed / modified upstream
1 GitHub repo (last check)
Improper authentication in Azure Spring Apps allows an authorized attacker to elevate privileges over a network.
azure_spring_apps >= 1.0.0 < 7.3.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-97785Critical· 10.0AAD App Proxy Elevation of Privilege Vulnerability
CVE-2025-49706Medium· 6.5Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
CVE-2024-49039High· 8.8Windows Task Scheduler Elevation of Privilege Vulnerability
CVE-2023-49105Critical· 9.8An issue was discovered in ownCloud owncloud/core before 10.13.1
CVE-2022-40684Critical· 9.8An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 …
CVE-2023-35078Critical· 9.8An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.