Breaking

Microsoft Mitigates CVSS 10.0 Azure AI Foundry Privilege-Escalation Flaw

September 18, 2026 at 08:51 EDT

Security
AI Agents

Microsoft has disclosed and mitigated CVE-2026-85889, a maximum-severity Azure AI Foundry elevation-of-privilege flaw caused by missing authentication for a critical function. The issue carries a CVSS 3.1 base score of 10.0, but Microsoft says the cloud-service vulnerability has been fully mitigated, requires no customer action, and is not known to have been exploited.

September 17, 2026 - Microsoft

Azure AI Foundry flaw fixed

A missing-authentication vulnerability in Azure AI Foundry reached CVSS 10.0, but Microsoft says the hosted-service issue is fully mitigated and requires no customer action.

10.0

CVSS base score

8.7

Temporal score

Customer action

Known exploitation

Severity changed by mitigation

The base score stays at the maximum, while the temporal score reflects an official fix and unproven exploit code.

10.0Base

8.7Temporal

The score drops only after factoring in the official service-side remediation; the underlying base scenario remains a maximum-severity authentication failure.

What the flaw path implies

Missing authCritical function lacked authentication

→

Network pathNo privileges or user interaction

Privilege riseHigh impact across CIA

Operational relief

Microsoft says the hosted-service flaw is fully mitigated, with no customer-side update required.

Residual concern

The advisory gives no vulnerable endpoints, exploit steps, or tenant-specific indicators, leaving teams to validate governance and logs.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.