Microsoft fixes maximum-severity Azure AI Foundry flaw

Microsoft has patched a maximum-severity vulnerability in Azure AI Foundry, its platform for building and running AI applications, that could have let an attacker with no credentials gain higher privileges over a network. The fix was reported on 18 September 2026. According to The Hacker News, Microsoft has already released the fixes and no customer action is required.

The flaw is tracked as CVE-2026-85889 and carries a CVSS score of 10.0, the highest possible rating on the Common Vulnerability Scoring System. In Microsoft's own description, quoted in the report, "Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network."

In plain terms, a function that should have checked who was calling it did not check at all. That class of problem — missing authentication on a sensitive operation — is why the score reached the top of the scale: it means an attacker does not need an account, a stolen token or any user interaction to reach the exposed function, and can do so remotely. A 10.0 rating is reserved for issues where the ease of attack and the potential damage are both at their maximum.

Because Azure AI Foundry is a cloud service, the remediation sits with Microsoft rather than with the people using it. That is the significance of the line that no customer action is required: the patch is applied on the service side, so there is no package to update or agent to redeploy. It also means customers had no way to mitigate the issue themselves before the fix landed.

The source does not say how the vulnerability was found, whether it was reported by an external researcher or discovered internally, or how long the flaw existed. There is no indication in the reporting that the issue was exploited, and no details have been published about which components or API endpoints were affected. Microsoft has not, according to the report, released proof-of-concept details or an exploitability assessment beyond the CVSS score and the advisory text.

For teams running agentic workloads on Azure AI Foundry, the practical takeaway is narrow but worth logging. Privilege escalation flaws in a platform that hosts model deployments, orchestration logic and connected tools are the kind of issue that can undercut every access control layered on top of it. Even where the vendor fixes the problem silently, security teams may want to record the CVE against their platform inventory, and review audit logs for the period before the patch, given that no self-service mitigation was available.