CVE-2026-85889: Azure AI Foundry’s CVSS 10.0 Flaw and What Developers Need to Know

Microsoft disclosed CVE-2026-85889, a CVSS 10.0 missing-authentication flaw in Azure AI Foundry, on September 17 and said no customer action is required because the fix was applied server-side across all tenants. Security researcher Rémy Marot discovered and reported the CWE-306 vulnerability, which allowed an unauthenticated, network-reachable attacker to escalate privileges with no credentials, low complexity, and no user interaction, with changed scope (S:C) potentially exposing Azure Key Vault secrets, Azure AI Search indexes, databases, Logic Apps, and MCP-connected systems. No evidence of exploitation in the wild exists, but because Foundry diagnostic logging is off by default, Microsoft has not published the patch timestamp or the vulnerability's introduction date, leaving most teams without audit logs for the at-risk window.

Microsoft disclosed CVE-2026-85889 on September 17 and assured customers no action is required. Technically, that is accurate — the fix was applied server-side across all Azure AI Foundry tenants simultaneously. Practically, it misses the point. The vulnerability carried a CVSS 10.0 score and allowed an unauthenticated attacker to escalate privileges over the network with zero credentials, zero complexity, and zero user interaction. If you run AI workloads on Azure Foundry and you do not know what your logs looked like in the days before September 17, you have an open question you have not answered yet. What the Flaw Actually Was The root cause is CWE-306: Missing Authentication for Critical Function https://cwe.mitre.org/data/definitions/306.html . A backend endpoint inside Azure AI Foundry had no authentication gate. An attacker who could reach it over the network — no special access required — could call that function and elevate their privileges. The CVSS vector tells you everything: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H . Network-reachable, low complexity, no privileges, no user interaction, and — critically — changed scope. That last element S:C is why CVSS hit the ceiling. Changed scope means the impact does not stay contained to the vulnerable component. It bleeds into connected resources: Azure Key Vault secrets, Azure AI Search indexes, databases, Logic Apps, MCP-connected enterprise systems — anything a Foundry project can reach. Security researcher Rémy Marot @R Marot https://twitter.com/R Marot discovered and reported the flaw through Microsoft’s coordinated disclosure program. There is no evidence it was exploited in the wild, but “no evidence” and “definitely not exploited” are not the same thing, especially when most Foundry deployments do not have diagnostic logging enabled by default. The Cloud-Patch Blind Spot Cloud CVEs follow an increasingly common pattern: vendor patches server-side, issues advisory, tells customers to do nothing. The advantage is real — instant remediation across all tenants, no patch cycle lag. But it creates an audit problem that rarely gets addressed. When Microsoft applied the fix, that timestamp is not shared publicly. The gap between when the vulnerability was introduced and when it was found is also unknown. For most teams, the Foundry diagnostic logging was not configured it is off by default , so the activity logs for the at-risk window either do not exist or were never routed anywhere reviewable. This is the third CVSS 10.0 flaw in a Microsoft AI or cloud identity platform in 2026: Azure AI Language Authoring earlier this year, Entra ID CVE-2026-69836 in August, and now Azure AI Foundry in September. The attack surface for AI infrastructure is expanding faster than the security controls are catching up. What to Do Now Microsoft’s “no action required” covers patching. It does not cover due diligence. If your team uses Azure AI Foundry, work through this list: - Pull access logs. Azure Activity Log and Foundry project audit records for the period before September 17. Look for unusual privilege escalations, unexpected API calls, or access from unfamiliar principals. - Enable diagnostic logging. Azure does not route AI diagnostic data by default. Add an azurerm monitor diagnostic setting resource in Terraform or configure it via the portal — route to Log Analytics or Storage. Do this now so you have a trail going forward. - Audit role assignments. Who holds Azure AI Developer or Contributor on your Foundry hub? Scope these to project level, not hub level. Hub-scoped roles grant broad access. - Map connected resources. Key Vault secrets, Azure AI Search indexes, databases, MCP servers, Logic Apps integrations — what can an elevated attacker reach from your Foundry project? Review and trim. - Use Microsoft Purview Audit to review Copilot and Foundry interactions during the at-risk window if you have Purview configured. - Acknowledge the advisory at the MSRC advisory page https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85889 . No patch to install, but log it as reviewed in your vulnerability management workflow. Broader Context Azure AI Foundry is a high-value target. It aggregates access to 11,000+ models across OpenAI, Anthropic, Meta, Mistral, and Microsoft’s own MAI family. More importantly, it sits between inference and enterprise data — connected to the secrets, indexes, and business logic that make AI agents actually useful. That positioning makes it attractive to attackers who want more than just a model call. Microsoft’s critical vulnerability count roughly doubled from 2024 to 2025. AI platforms are driving that trend. The controls are improving — but the surface is growing faster. A CVSS 10.0 flaw that requires no credentials and crosses scope boundaries is a reminder that securing AI infrastructure https://learn.microsoft.com/en-us/azure/security/fundamentals/ai-security-best-practices is still a work in progress. Review your Foundry configuration, enable logging, and treat this advisory as a prompt to audit — not a green light to move on. For related coverage on AI platform security vulnerabilities, see ByteIota’s recent reporting on LiteLLM CVE-2026-42271 https://byteiota.com/litellm-cve-2026-42271-cvss-10-0-chain-hits-ai-gateways/ and the OWASP Agent Control Standard https://byteiota.com/owasp-agent-control-standard-secure-your-ai-agents-now/ .