Microsoft Patches CVSS 10.0 Azure AI Foundry Flaw Enabling Unauthorized Privilege Escalation

Summary: Microsoft released fixes for CVE-2026-85889, a CVSS 10.0 missing-authentication flaw in Azure AI Foundry that Microsoft said allows an unauthorized attacker to elevate privileges over a network. Microsoft credited researcher Rémy Marot with reporting the flaw, said there is no evidence of exploitation in the wild, and stated the cloud vulnerabilities are already fully mitigated with no customer action required.
Why it matters: A 10.0 missing-authentication bug sat in the enterprise platform organizations use to build and run generative AI agents, and the fix arrived server-side with no action required from customers - meaning most will never see it in their own patch records.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-85889
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026