Microsoft Patches CVSS 10.0 Azure AI Foundry Flaw Enabling Unauthorized Privilege Escalation

Summary

Microsoft released fixes for CVE-2026-85889, a CVSS 10.0 flaw in Azure AI Foundry (also called Microsoft Foundry) that lets an unauthorized attacker over a network elevate privileges because of missing authentication for a critical function. Microsoft credited Rémy Marot with the discovery and said there is no evidence of in-the-wild exploitation. Microsoft also says no customer action is required.

Mitigation

Microsoft says the vulnerabilities have already been fully mitigated and require no action from users.

Related items

• InfoRadio With No Radar: Why Agent Runtime Security Fails Without the Layers Beneath ItSame vendor · The Hacker News
• InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSame vendor · Elastic Security Labs
• InfoMicrosoft named a Leader in the 2026 Gartner® Magic Quadrant™ for AI Agent Management Platforms  Same vendor · Microsoft Security Blog
• InfoCrowdStrike Advances AI Security and Safety from Endpoint to CloudSame vendor · CrowdStrike Blog
• InfoIntroducing AI Kill Switch: Taking Control When AI Agents Go RogueSame vendor · CrowdStrike Blog