// Microsoft 365CRITICAL
CVE-2026-85889, a CVSS 10.0 missing-authentication vulnerability in Azure AI Foundry, allows unauthenticated remote attackers to escalate privileges and take over AI workloads via the control plane. Microsoft patched the flaw server-side on September 18, 2026, requiring no customer action but leaving deployments invisible to outside auditing. The vulnerability was part of a 12-CVE cluster affecting Azure and Microsoft 365 services, with seven flaws reaching maximum CVSS scores, affecting over 100,000 enterprise customers.
// Get alerts for Microsoft 365