Microsoft has fixed a critical vulnerability in Azure AI Foundry that could have allowed an unauthenticated attacker to gain elevated privileges through the network. The flaw, CVE-2026-85889, received a CVSS score of 10.0, the maximum rating, because exploitation required neither existing permissions nor user interaction and was considered technically straightforward.

Azure AI Foundry is used by organizations to develop and operate generative AI models, applications, and autonomous agents. The platform’s position between models, enterprise data, identities, and downstream services makes an authorization failure especially sensitive, even though Microsoft says it found no evidence of attacks or public exploit code.

A missing check on a critical function

Microsoft classified the root cause as CWE-306, Missing Authentication for Critical Function. In practical terms, a backend operation that should have required a verified identity could be reached without valid credentials. An external attacker could therefore bypass the access controls intended to reserve privileged activity for authorized users.

The published severity metrics describe a network-accessible, low-complexity attack with no required privileges and no need to trick a victim into clicking or approving anything. Those characteristics explain the maximum score. Depending on the affected function and the connections configured in a customer environment, elevated access could potentially expose models, training or retrieval data, application secrets, agent workflows, or integrated enterprise systems.

Microsoft credited researcher Rémy Marot with finding and responsibly reporting the problem. The vendor’s advisory was released on September 17, bringing public attention to a weakness that Microsoft had already addressed in its managed infrastructure.

No customer patch, but not no customer action

Unlike a vulnerability in locally installed software, the Azure AI Foundry issue does not require customers to deploy an update. Microsoft says the backend remediation is complete and that users do not need to change configuration to receive the fix. That delivery model sharply reduces the window in which organizations may remain exposed because of slow patch rollouts.

Cloud-side remediation does not eliminate the value of review. Security teams can inspect audit records for unexpected privilege changes, unfamiliar identities, unusual model or data access, newly created credentials, and anomalous calls to connected resources during the period before mitigation. Organizations with sensitive Foundry deployments should confirm that logging reaches their central monitoring platform and that retention is long enough to support retrospective investigation.

AI platforms concentrate valuable permissions

Enterprise AI services increasingly act as orchestration layers rather than isolated chat interfaces. Agents may have permission to query internal knowledge stores, invoke APIs, process documents, create content, or operate cloud resources. A control-plane vulnerability can consequently create a path across boundaries that administrators assumed were separated.

Microsoft disclosed the Foundry issue near two other high-severity cloud and AI flaws: CVE-2026-85885, a command-injection vulnerability in Microsoft 365 Copilot scored 9.9, and CVE-2026-85878, an Azure Database for PostgreSQL authorization issue also scored 9.9. The cluster of advisories reinforces the need to include managed services in vulnerability and exposure programs even when the vendor, rather than the customer, owns patch deployment.

Practical controls around managed AI

Organizations can reduce the consequence of future platform flaws by applying several layers of control:

• Give Foundry projects and agents only the identities and data permissions they require.
• Separate development, testing, and production resources and avoid reusing high-value credentials.
• Use private connectivity and network restrictions where the service architecture supports them.
• Alert on privilege grants, secret access, new integrations, and atypical agent activity.
• Maintain an inventory of models, data sources, plugins, tools, and downstream services connected to each project.

CVE-2026-85889 is reported as fully mitigated, so the immediate risk is not an uninstalled customer patch. Its lasting importance is the trust concentrated in AI control planes. Teams should treat those platforms as privileged infrastructure, continuously validate their connections, and be ready to investigate service-level weaknesses with the same urgency applied to critical flaws on internet-facing servers.