Microsoft patched a vulnerability in Azure AI Foundry on September 18 that carried the highest possible severity score, a CVSS rating of 10.0, after determining that a critical function in the service lacked authentication and could allow an attacker to gain elevated privileges over a network without any credentials. The flaw, designated CVE-2026-85889, was fully mitigated by the fix, and Microsoft said customers do not need to take any action.
The underlying defect was straightforward, which is part of what made it severe. A function that should have required a user to prove who they were instead accepted requests from anyone who could reach it, and the escalation path from that missing check led to elevated privileges. In the scoring systems that security teams use to rank vulnerabilities, a network-reachable flaw that grants privilege escalation with no authentication and no user interaction lands at the top of the scale by definition.
Azure AI Foundry is Microsoft’s platform for building and running AI applications, a place where enterprises train and deploy models and connect them to their data. A flaw in that layer matters more than a flaw in an obscure internal component, because the platform sits close to the data and systems that its users are trying to protect. A missing authentication check in that context is the kind of defect that gets a name, a score, and a rapid response.
The same September 18 batch carried several other high-severity fixes. Microsoft patched a command-injection vulnerability in Microsoft 365 Copilot scored at 9.9, along with flaws in Azure Database for PostgreSQL and Cosmos DB that each rated 9.9 and 9.6 respectively. The grouping reflects a routine cadence in which Microsoft bundles its cloud-service fixes and releases them together, with the AI-related items drawing the most attention as AI becomes a larger share of what the platform hosts.
Microsoft’s disclosure for the Foundry flaw emphasized that the mitigation was complete and that no customer action was required, the standard language the company uses when it has already applied the fix to its managed infrastructure. The distinction matters: a flaw in a service Microsoft operates can be fixed silently on Microsoft’s side, whereas a flaw in software customers run themselves requires them to patch, a burden the Foundry customers were spared.
The Windows component of the update arrived separately. Microsoft released an out-of-band update, KB5129194, for Windows 11 26H1 to fix two local privilege-escalation vulnerabilities, the kind that matter when an attacker has already gained a foothold on a machine and is trying to deepen it. Out-of-band releases are reserved for fixes urgent enough that the company does not want to wait for the next scheduled patch cycle.
The 10.0 score is a rare designation. The CVSS scale runs to ten, but a perfect score is assigned only when a flaw is reachable over a network, requires no privileges, demands no user interaction, and compromises confidentiality, integrity, and availability together. Most vulnerabilities fall well short of that combination, which is why a perfect score draws attention disproportionate to the number of systems affected in practice.
The disclosure also fits a pattern the security industry has been watching: as AI platforms multiply, the attack surface they present grows with them. AI services sit on top of storage, networking, and identity systems, and a misconfiguration in any of those layers becomes a way into the model and the data it touches. Researchers have spent the past year cataloging the specific ways AI systems fail, from prompt injection to exposed credentials, and the Foundry flaw shows that the most damaging defects are often the oldest kind: a door left unlocked.
Microsoft’s security posture has been under public scrutiny in recent years, following breaches and criticism from regulators and customers over the pace of its fixes. The company has said it has reorganized its security operations and treats the work as a top priority, and the speed and completeness of the Foundry mitigation are the kind of response that posture is meant to produce.
Microsoft renamed and repositioned Azure AI Foundry as the single place where its AI tooling lives, folding in the model catalog, the agent-building tools, and the connections to enterprise data. That consolidation has made the platform a larger target as well as a more central one, and a defect in its authentication layer reaches across everything a customer has built on top of it. The fix matters because the platform’s customers have built their AI applications on the assumption that the foundation beneath them is sound.
What the disclosure does not reveal is whether anyone exploited the flaw before it was fixed. Microsoft’s advisory did not say the vulnerability had been used in attacks, which is the standard phrasing when no evidence of exploitation exists, but the absence of evidence is not the same as evidence of absence. For a platform that hosts enterprise AI workloads, the question of who might have walked through the unlocked door, and what they saw, is the one the advisory leaves open.
