CRITICAL: Microsoft Fixes CVSS 10.0 Azure AI Foundry Auth Bypass Flaw

Every so often a vendor hands out a perfect score, and it is never the kind of perfect score anyone wants. On September 17, 2026, Microsoft published an advisory for CVE-2026-85889, a missing authentication flaw in Azure AI Foundry that carries a CVSS 3.1 base score of 10.0. That is the ceiling. There is no 10.1. The advisory describes the bug in one terse sentence: "Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network."

Before anyone starts pulling the fire alarm, here is the good news up front. Azure AI Foundry is a hosted service, and Microsoft says it has already fully mitigated the issue on its own infrastructure. There is no patch to download, no MSI to push through your RMM, and no maintenance window to beg the client for. Microsoft also reports no evidence of exploitation in the wild and no public proof of concept. So why spend a whole article on a bug you cannot patch? Because the interesting part of this story is not the fix. It is what the bug says about where your clients' most sensitive data is quietly piling up, and how little visibility most of us have into it.

What Azure AI Foundry Actually Is

If the name does not ring a bell, you have probably seen it under one of its earlier labels. Azure AI Foundry, which Microsoft has also been branding simply as Microsoft Foundry, is the company's enterprise platform for building, deploying, and managing generative AI applications and agents. It is where development teams wire large language models to company data, set up retrieval pipelines against document stores, configure agents that can call tools and APIs, and manage the model deployments that sit behind internal chatbots and customer facing assistants.

In practical terms, a Foundry project tends to be a junction box. It holds connections to storage accounts full of source documents, to search indexes built from those documents, to databases, to Key Vault secrets, and to whatever line of business systems an agent has been granted permission to touch. Those connections are usually backed by managed identities or stored credentials with real permissions attached. That is exactly what makes a privilege escalation in this service such a big deal. The blast radius is not one model endpoint. It is everything that model endpoint was trusted to reach.

The Technical Details

CVE-2026-85889 is classified under CWE-306, Missing Authentication for Critical Function. The full CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, and every one of those letters is doing damage. The attack is reachable over the network, it requires low complexity, it needs no privileges, and it needs no user interaction. The scope is marked as changed, which means a successful attacker could affect resources beyond the vulnerable component itself, and confidentiality, integrity, and availability are all rated high.

Microsoft has not published a deep technical write up, which is typical for cloud service CVEs, but the shape of the problem is clear from the advisory and the coverage around it. A specific backend function inside Foundry that should have required an authenticated and authorized caller simply did not check. An attacker with no valid credentials could reach that function and abuse it, sidestepping the identity and access controls that were supposed to gate privileged operations. Reporting from Cybersecurity News notes that successful exploitation could have granted the same level of control as a legitimate privileged user, with potential exposure of AI models, training data, connected enterprise resources, and downstream systems integrated with Foundry based applications.

Anyone who has done web application testing will recognize the pattern immediately. Authentication is enforced at the front door, everyone assumes the back hallways are covered by the front door, and one internal route never got the memo. It is one of the oldest bug classes in the book, and it keeps showing up in shiny new platforms because the platforms are built fast and the plumbing underneath them is complicated.

The flaw was discovered by security researcher Rémy Marot and reported through Microsoft's coordinated disclosure process. Credit where it is due. Somebody found a maximum severity hole in a multitenant AI platform and handed it to the vendor instead of selling it, which in 2026 is worth a moment of appreciation.

Who Is Affected and What Exploitation Would Look Like

Every organization using Azure AI Foundry was theoretically exposed until Microsoft's server side fix landed. Since that fix is already in place, no customer is exposed today, and there is nothing to version check. Microsoft says it has seen no evidence of active exploitation, and no public exploit code has surfaced.

That said, "no evidence of exploitation" is a statement about what Microsoft observed, and cloud providers do not always have perfect insight into what happened inside a tenant before a fix shipped. We do not know how long the flaw existed before it was reported. If a skilled attacker had stumbled onto it first, the realistic playbook would have been to use the escalated access to enumerate projects and connections, pull stored secrets or tokens tied to connected resources, read or tamper with the documents feeding retrieval pipelines, and potentially modify agent configurations so they quietly leak data or take actions on the attacker's behalf. None of that would look like classic malware. It would look like API calls and configuration changes, which is precisely why logging matters here.

It is also worth noting the company this CVE kept. The same round of Microsoft cloud disclosures included CVE-2026-85885, a command injection flaw in Microsoft 365 Copilot rated 9.9, CVE-2026-85878, an improper authorization issue in Azure Database for PostgreSQL also rated 9.9, and CVE-2026-87701, a neutralization flaw in Azure Cosmos DB rated 9.6. Four cloud bugs rated 9.6 or higher in one batch should reset anyone's assumption that SaaS and PaaS services are someone else's problem. They are someone else's patch. They are still your risk.

What To Do About a Bug You Cannot Patch

The honest answer is that there is no emergency action required for CVE-2026-85889 itself. But "no action required" is not the same thing as "nothing worth doing," and a vendor remediated cloud CVE is a good excuse to tighten up the things you should have been doing anyway.

Start with documentation. Record the CVE, the advisory date, and Microsoft's statement that the service was remediated on the provider side. If a client lives under a compliance framework like SOC 2, HIPAA, or CMMC, their auditors increasingly want to see that cloud provider vulnerabilities are tracked through the same vulnerability management process as on premises ones, even when the resolution is simply "vendor fixed." A one line entry in the risk register today saves an awkward conversation six months from now.

Next, go look at the Foundry footprint. Plenty of organizations have AI projects that were spun up by a developer during a proof of concept and never touched again. Inventory every Foundry hub and project across your client tenants, identify who owns each one, and shut down anything that is abandoned. An unused project with a live connection to a production storage account is pure liability.

Then audit the permissions behind those projects. Check which managed identities and service principals the Foundry resources use and what role assignments they hold. It is very common to find a project identity with Contributor or even Owner at the subscription level because it was faster than scoping it properly. Pull those rights back to the specific storage accounts, search indexes, and Key Vaults each project genuinely needs. If a future bug in this service or any other AI platform does get exploited, least privilege is the difference between an incident and a catastrophe.

Logging is the other half of the job. Make sure Azure Activity Logs and Entra ID sign in and audit logs are being retained and sent somewhere your team or your SOC actually looks, whether that is Microsoft Sentinel or another SIEM. Turn on diagnostic settings for the Foundry and Azure AI resources so data plane activity is captured, not just management operations. Useful detections to consider include unexpected role assignment changes on AI resources, new connections or credentials added to Foundry projects, agent or deployment configuration changes outside normal change windows, and access to Key Vault secrets by identities that do not usually read them. If you have retained logs going back several months, a quick hunt for unusual activity against Foundry resources is cheap insurance, even with Microsoft saying it saw nothing.

Finally, consider network exposure. Foundry and its dependent resources support private endpoints and restricted public network access. Where the workload allows it, keep the data sources behind private networking so that even a platform level flaw has a harder time turning into bulk data access. Defense in depth sounds like a slide deck cliché until the one control you trusted turns out to have a missing auth check behind it.

The Bigger Picture

AI platforms are becoming the new crown jewels, and most organizations have not updated their threat models to match. A Foundry project that indexes a company's contracts, HR policies, and customer records is effectively a searchable copy of the most sensitive data the business owns, fronted by an API and connected to systems that can take actions. That is an extremely attractive target, and the security tooling around it is still immature compared to what we have for endpoints and email.

Microsoft deserves some credit here. Publishing CVEs for cloud service bugs that customers cannot patch is a relatively recent practice across the industry, and it gives defenders something they did not used to get, which is a paper trail. Five years ago a flaw like this might have been fixed silently with nobody outside Redmond ever the wiser. Transparency does not make the bug less severe, but it does let us have an informed conversation with clients about what they are actually trusting when they build on these platforms.

The takeaway for MSPs and internal security teams is straightforward. CVE-2026-85889 is fixed, and you do not need to patch anything. Use it as the push to find every AI workload your clients are running, cut the permissions those workloads have down to what they actually need, and make sure that if the next perfect ten is exploited before the vendor catches it, you will at least see it happen.

MSP Angle

This advisory is a clean, low drama opening for an AI security posture review. Offer clients a fixed scope assessment that inventories their Azure AI Foundry and Copilot footprint, right sizes managed identity permissions, and turns on the logging and alerting to catch abuse, then roll the monitoring into an ongoing managed detection agreement.