Back Socdefenders.Ai

Microsoft Patches CVSS 10.0 Azure AI Foundry Flaw Enabling Unauthorized Privilege Escalation

Socdefenders.Ai • September 18, 2026

Microsoft has patched a critical vulnerability in Azure AI Foundry (CVE-2026-85889) that allows unauthorized privilege escalation due to missing authentication for critical functions.

The flaw, with a CVSS score of 10.0, affects the Azure AI Foundry platform but has not been reported as exploited in the wild. No customer action is required as the vulnerability has been fully mitigated by Microsoft.

Security teams should ensure that their Azure AI Foundry instances are updated to the latest version to protect against this and other vulnerabilities.

Technical Details: CVE-2026-85889 allows attackers to elevate privileges over a network due to insufficient authentication mechanisms within Azure AI Foundry.

MITRE ATT&CK Techniques: None mentioned

IOCs Mentioned: None mentioned

Join 5,000+ security professionals

Get access to curated threat intel, upvote articles, join discussions, and build your karma in the SOC community.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft Addresses CVSS 10 Vulnerability in Azure AI Foundry On September 17, 2026, Microsoft patched a critical vulnerability in Azure AI Foundry, identified as CVE-2026-85889, which had a CVSS score of 10.0. This flaw allowed unauthorized privilege escalation due to missing authentication for critical functions. The vulnerability affects Azure AI Foundry, a platform for developing generative AI applications, but there is no evidence of exploitation in the wild. Microsoft also addressed additional vulnerabilities in other products, including two in Windows that require manual updates. Security researcher Rémy Marot discovered the flaw, and Microsoft has advised that no customer action is needed for the Azure AI Foundry patch. However, administrators must manually install the cumulative update KB5129194 for the two Windows vulnerabilities. Overall, Microsoft patched 18 vulnerabilities across various products in this update cycle. 7 sources 58

Extracted Entities

Microsoft Patches CVSS 10.0 Azure AI Foundry Flaw Enabling Unauthorized Privilege Escalation

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)

CWE Weaknesses (1)