Microsoft Discloses Critical CVSS 10 Azure AI Foundry Privilege Escalation Flaw

Microsoft has disclosed a critical security vulnerability in Azure AI Foundry that could allow an unauthorized attacker to elevate privileges over a network.

Tracked as CVE-2026-85889, the vulnerability carries a maximum CVSS 3.1 score of 10.0, placing it in the highest severity category under the scoring system.

Microsoft published the vulnerability on September 17, 2026, describing it as an elevation-of-privilege issue caused by missing authentication for a critical function.

The company says the vulnerability has already been fully mitigated and that customers do not need to take any action.

The disclosure is part of Microsoft's approach to providing greater transparency around vulnerabilities affecting cloud services.

What Is CVE-2026-85889?

Microsoft describes CVE-2026-85889 as a missing authentication for a critical function vulnerability in Azure AI Foundry.

The weakness is classified under CWE-306: Missing Authentication for Critical Function.

According to Microsoft's advisory:

"Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network."

The vulnerability has the following CVSS 3.1 characteristics:

The CVSS vector published by Microsoft is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C

The combination of network reachability, low attack complexity, no required privileges and no user interaction contributes to the maximum base score.

However, the CVSS rating describes the technical characteristics and potential impact of the vulnerability. It does not by itself indicate that the vulnerability was exploited in real-world attacks.

Microsoft Says No Customer Action Is Required

One of the most important details in Microsoft's advisory is that organizations using the affected cloud service do not need to install a patch or change their configuration.

Microsoft states that the vulnerability has already been fully mitigated.

The company explains that there are no update links or customer remediation instructions because the issue has already been addressed on the service side.

Microsoft says the CVE was published primarily to provide additional transparency about the security issue.

This approach is part of Microsoft's broader effort to disclose vulnerabilities affecting cloud services through CVE records, even when customers are not required to apply traditional software updates.

No Evidence of Exploitation

Microsoft's advisory says the vulnerability was not publicly disclosed before its publication and was not known to have been exploited.

The Microsoft exploitability assessment is listed as N/A.

The Hacker News separately reported that there was no evidence the vulnerability had been exploited in the wild.

This distinction is important.

A CVSS 10.0 vulnerability can represent severe potential impact based on its technical characteristics without there being evidence that attackers have actually exploited it.

In this case, Microsoft specifically states that the issue was not publicly disclosed and had not been exploited at the time of publication.

Security Researcher Rémy Marot Credited

Microsoft credited security researcher Rémy Marot for discovering and reporting CVE-2026-85889.

The acknowledgment reflects Microsoft's coordinated vulnerability disclosure process.

The company did not provide additional technical details about how the vulnerability was discovered or how the missing authentication could be abused.

Additional details were not disclosed in the announcement.

Why the Vulnerability Matters for Azure AI Foundry

Azure AI Foundry is Microsoft's platform for building, deploying and managing generative AI applications and agents. The Hacker News describes it as an enterprise platform for developing and managing AI applications and agents.

An elevation-of-privilege vulnerability is significant because successful exploitation can allow an attacker to obtain permissions beyond those they were originally authorized to have.

In this case, Microsoft says the vulnerability could allow an unauthorized attacker to elevate privileges over a network.

The advisory does not disclose the specific critical function involved, the affected service component, or a step-by-step exploitation path.

Those details should not be inferred from the CVSS metrics alone.

Microsoft's Cloud CVE Transparency Approach

The advisory also illustrates an important difference between vulnerabilities in traditional software and vulnerabilities in cloud services.

With traditional software, a security advisory commonly includes a patch or update that customers need to install.

For this Azure AI Foundry vulnerability, Microsoft says the service has already been mitigated.

That means there is no customer-side patching procedure associated with CVE-2026-85889.

Microsoft directs readers to its guidance on cloud service CVE transparency, which explains why cloud vulnerabilities can receive CVE records even when no customer action is required.

The disclosure gives customers and security teams a record of the vulnerability while Microsoft handles the mitigation within the service.

Other Critical Microsoft Vulnerabilities Reported Alongside the Disclosure

The Hacker News report places CVE-2026-85889 alongside several other high-severity vulnerabilities Microsoft addressed around the same period. These include issues affecting Microsoft 365 Copilot, Azure Database for PostgreSQL and Azure Cosmos DB.

They include:

• CVE-2026-85885: CVSS 9.9, a command injection vulnerability in Microsoft 365 Copilot that could allow an authorized attacker to elevate privileges over a network.

• CVE-2026-85878: CVSS 9.9, an improper authorization vulnerability in Azure Database for PostgreSQL that could allow an authorized attacker to elevate privileges over a network.

• CVE-2026-87701: CVSS 9.6, an improper neutralization vulnerability in Azure Cosmos DB that could allow an authorized attacker to elevate privileges over a network.

The Hacker News reported that Microsoft said these cloud-related vulnerabilities had already been fully mitigated and did not require customer action.

These vulnerabilities are separate from CVE-2026-85889 and should not be treated as part of the same Azure AI Foundry flaw.

Separate Windows Vulnerabilities Also Addressed

The Hacker News report also notes two additional vulnerabilities addressed through an out-of-band update for Windows 11 version 26H1.

These were:

• CVE-2026-62721: CVSS 7.8, an insufficient granularity of access control vulnerability in Windows User-Mode Power Service that could allow an authorized attacker to elevate privileges locally and gain SYSTEM privileges.

• CVE-2026-85921: CVSS 8.2, a double-free vulnerability in Windows Secure Kernel Mode that could allow an authorized attacker to elevate privileges locally and gain Virtual Trust Level 1 privileges.

The update referenced by The Hacker News is KB5129194, covering Windows 11 version 26H1 for both Arm64 and x64 systems.

These Windows issues are separate from CVE-2026-85889 and do not change Microsoft's stated remediation status for the Azure AI Foundry vulnerability.

The Broader Microsoft Vulnerability Landscape

The disclosure also comes amid a period of significant vulnerability activity across Microsoft's software portfolio.

The Hacker News reported that Microsoft had patched 974 vulnerabilities earlier in September, including two Windows vulnerabilities that were being actively exploited.

The report said the Windows Advanced Local Procedure Call vulnerability had been chained with two Google Chrome vulnerabilities in an exploit kit referred to as BlueMoon, based on reporting from Proofpoint and Volexity.

That activity is separate from CVE-2026-85889.

There is currently no indication in Microsoft's advisory that the Azure AI Foundry vulnerability was part of those attacks.

What Enterprises Should Know

For organizations using Azure AI Foundry, the most relevant point is straightforward: Microsoft says no customer action is required for CVE-2026-85889 because the vulnerability has already been fully mitigated.

Security teams can still record the CVE in vulnerability inventories and track the advisory as part of their security documentation and third-party risk processes.

The vulnerability is also a reminder that cloud services can have security issues even when customers do not control the underlying infrastructure.

In this case, Microsoft's disclosure provides visibility into the issue while the provider handles the remediation.

Organizations should distinguish between:

• A vulnerability that requires customers to install a security update

• A cloud-service vulnerability already mitigated by the provider

• A vulnerability with confirmed exploitation

• A vulnerability that has not been observed being exploited

CVE-2026-85889 currently falls into the second and fourth categories based on Microsoft's published advisory.

What Microsoft Has Not Disclosed

Microsoft's advisory does not provide a detailed technical description of the vulnerable function or an exploitation procedure.

It also does not disclose:

• The specific Azure AI Foundry component affected

• A proof-of-concept exploit

• Technical exploitation steps

• Indicators of compromise

• Evidence of exploitation in the wild

• Customer-side configuration changes

• A customer patch or update package

Additional details were not disclosed in the announcement.

The absence of these details is consistent with Microsoft's statement that the vulnerability has already been fully mitigated and requires no customer action.

Conclusion

CVE-2026-85889 is a critical Azure AI Foundry elevation-of-privilege vulnerability with a CVSS 3.1 score of 10.0.

Microsoft attributes the issue to missing authentication for a critical function and says an unauthorized attacker could exploit it over a network to elevate privileges.

The vulnerability has no reported public disclosure or known exploitation, according to Microsoft's advisory, and Microsoft says it has already fully mitigated the issue.

Most importantly for Azure AI Foundry customers, no action is required.

The disclosure nevertheless provides useful visibility into security risks affecting cloud-based AI infrastructure and demonstrates Microsoft's approach of publishing CVEs for cloud-service vulnerabilities even when the provider has already addressed the underlying issue.