CVE-2026-70352

www.tenable.com • September 18, 2026

Share: View original

Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network.

Published : 2026-09-03

Vector : CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft Addresses CVSS 10 Vulnerability in Azure AI Foundry On September 17, 2026, Microsoft patched a critical vulnerability in Azure AI Foundry, identified as CVE-2026-85889, which had a CVSS score of 10.0. This flaw allowed unauthorized privilege escalation due to missing authentication for critical functions. The vulnerability affects Azure AI Foundry, a platform for developing generative AI applications, but there is no evidence of exploitation in the wild. Microsoft also addressed additional vulnerabilities in other products, including two in Windows that require manual updates. Security researcher Rémy Marot discovered the flaw, and Microsoft has advised that no customer action is needed for the Azure AI Foundry patch. However, administrators must manually install the cumulative update KB5129194 for the two Windows vulnerabilities. Overall, Microsoft patched 18 vulnerabilities across various products in this update cycle. 7 sources 58

Extracted Entities

Companies (1)

CVEs (1)

CWE Weaknesses (2)

CWE-269 - Improper Privilege Management CWE-287 - Improper Authentication