// Microsoft AzureCRITICAL
CVE-2026-85889, a CVSS 10.0 missing-authentication vulnerability in Azure AI Foundry, enables unauthenticated privilege escalation over the network with high impact to confidentiality, integrity, and availability. Microsoft patched the flaw server-side on September 18, 2026, as part of a 12-CVE cluster affecting multiple Azure and Microsoft 365 services. The vulnerability affects Azure AI Foundry's control plane, potentially allowing unauthorized access to model deployments, agent management, and AI workload provisioning affecting over 100,000 enterprise customers.
- Azure AI Foundry CVSS 10 Flaw: No Patch Needed [2026](opens in a new tab)
- Breach Watch Weekly: When the Attacker Is an AI Agent (Sep 20-24(opens in a new tab)
// Get alerts for Microsoft Azure