Azure AI Foundry CVE-2026-85889: CVSS 10 Flaw Is Already Mitigated
Microsoft disclosed CVE-2026-85889 on September 17, 2026, a CVSS 3.1 10.0 Critical vulnerability in Azure AI Foundry caused by missing authentication for a critical function. Microsoft's CVE record says an unauthorized network attacker could elevate privileges, with no prior privileges or user interaction required.
The vulnerability affects Microsoft's hosted Azure AI Foundry service. Microsoft has already fully mitigated the issue, and customers have no patch or update to install. The disclosure provides a public record of a cloud-service flaw that Microsoft remediated on its side.
The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H: network reachable, low attack complexity, no privileges required, no user interaction, changed scope, and high potential impact to confidentiality, integrity and availability.
CVE-2026-85889 at a glance
| Item | CVE-2026-85889 |
|---|---|
| Product | Microsoft Azure AI Foundry |
| Published | September 17, 2026 |
| Severity | Critical |
| CVSS 3.1 | 10.0 |
| Weakness | CWE-306: Missing Authentication for Critical Function |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Changed |
| Customer patch required | No |
| Remediation | Already applied by Microsoft to the hosted service |
What the vulnerability means
CWE-306 describes a security-sensitive function that can be reached without the authentication control intended to protect it. Microsoft's published description for CVE-2026-85889 states that the Azure AI Foundry flaw allowed an unauthorized attacker to elevate privileges over a network.
The CVSS vector gives the clearest public description of the risk boundary. Exploitation was assessed as remotely reachable with low complexity and without an authenticated account or user action. The changed-scope rating indicates that successful exploitation could affect resources beyond the vulnerable security authority, while the confidentiality, integrity and availability components are all rated High.
Microsoft's public record does not describe the affected internal function or publish an exploit chain. Those implementation details are unnecessary for the immediate customer decision because remediation has already been deployed to the managed service.
There is no Azure AI Foundry update for customers to install
CVE-2026-85889 is an exclusively hosted-service vulnerability. Microsoft states that the vulnerability has been fully mitigated and that users of the service have no action to take to apply the fix.
That remediation model differs from a CVE in self-managed software. There is no affected-version-to-fixed-version upgrade table for administrators to follow. The CVE record identifies Azure AI Foundry as the affected product while the hosted platform itself is maintained by Microsoft.
For security teams, the useful operational action is therefore inventory and assurance rather than emergency patch deployment. Record the CVE against Azure AI Foundry usage, confirm that incident-response and Azure logging coverage is appropriate for sensitive AI workloads, and retain the Microsoft advisory with the service's security documentation.
Why the 10.0 score still matters
A vendor-side fix removes the current remediation burden, while the original vulnerability severity remains relevant to risk history. CVSS 10.0 reflects the conditions and potential impact of the flaw before mitigation; it is not a statement that every Azure AI Foundry tenant is presently exposed.
This distinction is especially important for managed cloud services. A conventional vulnerability scanner may have no package version or appliance build to identify because the vulnerable component lives in provider-operated infrastructure. Cloud CVE handling therefore needs to track provider remediation status alongside the severity score.
The disclosure is also useful for organizations that include AI platforms in supplier-risk or security-review processes. Azure AI Foundry can sit close to model deployments, agents, data connections and application credentials, so provider-side authorization defects belong in the same risk history as other consequential cloud-control-plane vulnerabilities.
A broader Microsoft cloud disclosure batch
CVE-2026-85889 arrived as part of a larger September 17 set of Microsoft cloud-service disclosures. Independent reporting identified multiple Critical Azure and Microsoft 365 service vulnerabilities in the batch, including several CVSS 10.0 records. Microsoft had already remediated the hosted-service issues before disclosure.
Azure AI Foundry also received CVE-2026-85917, a separate server-side request forgery vulnerability scored CVSS 7.5. Microsoft's record describes that flaw as allowing an unauthorized network attacker to elevate privileges. Keeping the identifiers separate matters because they represent different weakness classes and severity profiles.
What Azure AI Foundry operators should record
Organizations using Azure AI Foundry should add CVE-2026-85889 to their cloud-security evidence with Microsoft's remediation status and disclosure date. Environments with formal vulnerability SLAs can close the patching action as provider-remediated while retaining the event for audit and supplier-risk history.
Security monitoring around AI workloads remains valuable independently of this specific fix. Azure activity and identity logs, least-privilege role assignments, private networking where appropriate, and alerting for unexpected resource or permission changes provide controls for both provider defects and customer-side configuration failures.
Bottom line
CVE-2026-85889 is a CVSS 10.0 missing-authentication vulnerability in Azure AI Foundry that allowed unauthorized network privilege escalation. Microsoft disclosed it on September 17 after fully mitigating the hosted service. Customers do not need to install an update.
The practical response is to record the provider-side remediation, preserve the advisory for vulnerability and supplier-risk tracking, and maintain normal Azure identity, logging and workload-security controls. The severity describes the original flaw; Microsoft's completed cloud remediation determines the current patching requirement.
Sources
- Microsoft Security Response Center — CVE-2026-85889: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85889
- CVE Program record / Microsoft CNA data: https://www.cve.org/CVERecord?id=CVE-2026-85889
- Microsoft Security Response Center — September 2026 Security Updates: https://msrc.microsoft.com/update-guide/releaseNote/2026-Sep
- The Hacker News — Microsoft patches CVSS 10.0 Azure AI Foundry flaw: https://thehackernews.com/2026/09/microsoft-patches-cvss-100-azure-ai.html