Breaking

Microsoft Mitigates CVSS 10.0 Azure AI Foundry Privilege-Escalation Flaw

September 18, 2026 at 10:23 EDT

Security
AI Agents

Microsoft has mitigated a maximum-severity flaw in Azure AI Foundry, assigning CVE-2026-85889 a CVSS base score of 10.0 after a missing-authentication weakness made privilege escalation possible over the network. The hosted-service issue was published on September 17, 2026, and Microsoft says it has already been fully mitigated with no customer action required and no known exploitation.

September 17, 2026 - Microsoft

Azure AI Foundry CVSS 10.0 flaw mitigated

A missing-authentication issue in Azure AI Foundry allowed network-based privilege escalation in a hosted AI-agent platform. Microsoft says the issue is already mitigated and customers have no update to apply.

10.0

CVSS base score

8.7

Temporal score

Customer updates required

AI and cloud fixes in the set

A full-scale CVSS severity reading

10 of 10

Network reachable, low complexity, no privileges, no user interaction.

Why the score is maximum

The advisory rates confidentiality, integrity and availability impact as high, with scope changed across the affected hosted service.

How the risk path reads

Critical function lacks authentication

→

Unauthorized network attacker can escalate

→

Provider mitigation closes the hosted-service issue

Operational relief

The cloud service has been mitigated centrally, and the public record lists no customer-side update requirement.

Governance warning

Foundry can govern agents, tools and business-data connections, so identity boundaries remain the key review area.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.