Microsoft patches CVSS 10.0 Azure AI Foundry flaw (CVE-2026-85889)
Microsoft issued an out‑of‑band update that fixes a CVSS 10.0 vulnerability in Azure AI Foundry, also known as Microsoft Foundry. The flaw (CVE‑2026‑85889) allowed an unauthenticated attacker to elevate privileges over a network, but Microsoft said there is no evidence of exploitation and no customer action is required. Security researcher Rémy Marot was credited for discovering the issue.
Key points
- Azure AI Foundry CVE‑2026‑85889 scored 10.0 and allowed unauthenticated privilege escalation
- Microsoft credited researcher Rémy Marot and said no evidence of wild exploitation
- Microsoft patched a record 974 vulnerabilities in September, including two actively exploited Windows bugs
The advisory also listed several other critical patches released at the same time, including CVE‑2026‑85885 and CVE‑2026‑85878 (both CVSS 9.9) affecting Microsoft 365 Copilot and Azure Database for PostgreSQL, and CVE‑2026‑87701 (CVSS 9.6) in Azure Cosmos DB. Earlier in September, Microsoft patched a record 974 vulnerabilities across its portfolio, with two Windows bugs actively exploited in the wild and linked to the BlueMoon exploit kit used by espionage‑aligned actors.
These updates demonstrate Microsoft’s rapid response to high‑severity flaws in its cloud and AI services, aiming to protect enterprise customers from privilege‑escalation attacks.
Microsoft Patches CVSS 10.0 Azure AI Foundry Flaw Enabling Unauthorized Privilege Escalation
thehackernews.com · 18 September 2026
Loading the full article…
This text was published by thehackernews.com and written by The Hacker News. It is reproduced here with attribution so you can read it in full; the rights remain with the publisher. Read it at the source ↗
The headline, key points and digest above were generated by Digest AI's editorial model from the linked sources. Automated summaries can contain errors: the sources are the record. Spotted a mistake? Tell us. Published by Martin K., who runs Digest AI and handles corrections.
More in Enterprise & Industry
All →- Cyara’s CEO outlines AI agent oversight as a workforce model · 1 src
- Arcana adds institutional portfolio data to Claude’s connectors · 1 src
- Anthropic brings Claude inference to India via Amazon Bedrock · 6 src
- Infor adds industry-specific AI agents to Velocity Suite, citing generic AI gaps · 1 src
- Tech Mahindra trains 12,500+ staff on Google’s Gemini Enterprise agents · 1 src
Comments
via GitHub Discussions