Threat
Microsoft Patches CVSS 10.0 Azure AI Foundry Flaw Enabling Unauthorized Privilege Escalation
Publication date not yet evaluated · Added thehackernews.com
Page published · Page updated
Coverage timeline
Single-source advisory — one report is available.
Why it matters
CVE-2026-85889 exposes an enterprise AI agent platform to unauthenticated privilege escalation, meaning a flaw in the AI build/deploy fabric itself could hand attackers control over generative-AI applications and agents.
Microsoft patched CVE-2026-85889, a maximum-severity (CVSS 10.0) flaw in Azure AI Foundry (Microsoft Foundry) caused by missing authentication for a critical function, allowing an unauthorized attacker to elevate privileges over a network. The platform is used to build, deploy, and manage generative AI applications and agents; no customer action is required and there is no evidence of in-the-wild exploitation. The flaw was reported by researcher Rémy Marot.
Summary
Microsoft has released fixes for a maximum-severity (CVSS 10.0) vulnerability in Azure AI Foundry, tracked as CVE-2026-85889, that could be abused for privilege escalation. The flaw stems from missing authentication for a critical function, allowing an unauthorized attacker to elevate privileges over a network. As a cloud-side issue, Microsoft says it has been fully mitigated with no customer action required.[1][8]
There is no evidence the Azure AI Foundry flaw has been exploited in the wild, and it was reported through responsible disclosure by security researcher Rémy Marot (@R_Marot). Alongside it, Microsoft patched several other high-severity cloud flaws in Microsoft 365 Copilot, Azure Database for PostgreSQL, and Azure Cosmos DB, plus two Windows kernel/service elevation-of-privilege bugs addressed via an out-of-band Windows 11 26H1 update.[1][11][12][13][14][15][16]
Disclosure timeline
| Date | Event |
|---|---|
| 2026-09-18 | The Hacker News reports Microsoft's Thursday advisory disclosing and patching CVE-2026-85889 in Azure AI Foundry along with other critical cloud and Windows flaws.[1][8] |
How it works
CVE-2026-85889 is a missing-authentication-for-critical-function vulnerability in Azure AI Foundry (also called Microsoft Foundry), an enterprise platform for building, deploying, and managing generative AI applications and agents. Because a critical function lacks authentication, an unauthorized attacker can elevate privileges over a network, yielding the maximum CVSS score of 10.0.[1][8][9]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| Azure AI Foundry (Microsoft Foundry) | Cloud service affected by CVE-2026-85889 (CVSS 10.0) | Fully mitigated by Microsoft on the cloud side; no customer action required[1][8] |
| Microsoft 365 Copilot | CVE-2026-85885 (CVSS 9.9) command injection | Mitigated by Microsoft; no user action required[1][11] |
| Azure Database for PostgreSQL | CVE-2026-85878 (CVSS 9.9) improper authorization | Mitigated by Microsoft; no user action required[1][12] |
| Azure Cosmos DB | CVE-2026-87701 (CVSS 9.6) improper neutralization | Mitigated by Microsoft; no user action required[1][13] |
| Windows 11, version 26H1 | CVE-2026-62721 (CVSS 7.8) UMPS local EoP to SYSTEM; CVE-2026-85921 (CVSS 8.2) Secure Kernel Mode double free (VTL1 EoP) | Fixed in out-of-band update KB5129194 (build 28000.2956) for arm64 and x64[1][14][15][16] |
Key takeaways
- A missing-authentication flaw scoring the maximum CVSS 10.0 in Azure AI Foundry underscores how quickly critical exposure can arise in enterprise generative-AI platforms; it was mitigated cloud-side with no customer action and no evidence of in-the-wild exploitation.[1][8]
- While the cloud CVEs are auto-remediated, defenders must still deploy the out-of-band Windows 11 26H1 update KB5129194 to fix the local elevation-of-privilege vulnerabilities that require customer action.[1][16]
Defensive actions
- Apply the out-of-band Windows 11 version 26H1 update KB5129194 to remediate the local elevation-of-privilege flaws CVE-2026-62721 and CVE-2026-85921.: These two Windows flaws are addressed only through the KB5129194 cumulative update and, unlike the cloud CVEs, require customer deployment to be protected.[1][16]
- Verify no additional action is needed for the cloud-side CVEs but track them for audit and compliance purposes.: Microsoft states the Azure AI Foundry, Copilot, PostgreSQL, and Cosmos DB vulnerabilities are fully mitigated at the service level with no customer action required.[1]