Live Feeds
● LIVE Updated 1d ago · 35 sources tracked

Microsoft Patches CVSS 10.0 Azure AI Foundry Flaw Enabling Unauthorized Privilege Escalation

Microsoft resolved a maximum-severity CVSS 10.0 vulnerability impacting Azure AI Foundry that allowed unauthorized privilege escalation and missing authentication. Designated as CVE-2026-85889 and CVE-2026-108456, the server-side request forgery flaw enabled an authorized attacker to elevate privileges over a network. Because Microsoft applied the fix directly on its servers, customers do not need to perform manual installations or updates. The platform currently has five published CVEs associated with it, while the Cybersecurity and Infrastructure Security Agency Known Exploited Vulnerabilities database lists zero CVEs for the service at this time.

🎙️

Listen to Live Briefing

Real-time synthesized voice briefing · Live Feeds Desk

⏱ ~3 min
Speed:
RSS Source map (35)
⚡ Key Developments & Real-Time Context
Text size:
  • ✓ Microsoft classified CVE-2026-85889 as a missing authentication flaw in Azure AI Foundry with a CVSS score of 10.0.
  • ✓ The vulnerability was mitigated on the server side, requiring no patching actions from customers.
🛡️ Source Corroboration: 35 independent reporting domains (100% confidence) ⏱ Read time: ~2 min

What changed

Corroborated reports reaffirm that Microsoft implemented the CVE-2026-85889 fix entirely on the server side without requiring customer action.

Live updates

  1. Microsoft Resolves Critical CVSS 10.0 Azure AI Foundry Vulnerabilities

    Microsoft resolved a maximum-severity CVSS 10.0 vulnerability impacting Azure AI Foundry that allowed unauthorized privilege escalation and missing authentication. Designated as CVE-2026-85889 and CVE-2026-108456, the server-side request forgery flaw enabled an authorized attacker to elevate privileges over a network. Because Microsoft applied the fix directly on its servers, customers do not need to perform manual installations or updates. The platform currently has five published CVEs associated with it, while the Cybersecurity and Infrastructure Security Agency Known Exploited Vulnerabilities database lists zero CVEs for the service at this time.

    Why it matters

    The platform requires server-side maintenance due to the nature of cloud-hosted artificial intelligence infrastructure. Security advisories identify missing authentication as a key component of the maximum-severity score. Monitoring databases continue to track zero exploitation records despite the top-tier severity rating assigned to the flaws.

    What is confirmed

    • Microsoft classified CVE-2026-85889 as a missing authentication flaw in Azure AI Foundry with a CVSS score of 10.0.
    • The vulnerability was mitigated on the server side, requiring no patching actions from customers.

    What to watch next

    • Any updates from the Cybersecurity and Infrastructure Security Agency regarding the addition of CVE-2026-85889 to the Known Exploited Vulnerabilities database.
    • Further disclosures concerning the remaining published CVEs associated with Azure AI Foundry.
    Sources used for this update (5)
    1. www.orcarouter.ai — Azure AI Foundrys autentiseringsfel med CVSS 10.0 – åtgärdat ...
    2. www.orcarouter.ai — Azure AI Foundry 的 CVSS 10.0 身分驗證漏洞，已在伺服器端修復
    3. thehackernews.com — CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key
    4. senserva.com — Free Microsoft Patch Feeds and API: Industry's Hot Patches ...
    5. shattered.io — Kubernetes Vulnerability: Azure Flaw Hits CVSS 10.0 [2026]
    confidence 100%

  2. Microsoft Fixes Critical Azure AI Foundry Security Flaw

    Microsoft resolved a maximum-severity CVSS 10.0 vulnerability impacting Azure AI Foundry that allowed unauthorized privilege escalation and missing authentication. Designated as CVE-2026-85889 and CVE-2026-108456, the server-side request forgery flaw enabled an authorized attacker to elevate privileges over a network. Because Microsoft applied the fix directly on its servers, customers do not need to perform manual installations or updates. The platform currently has five published CVEs associated with it, while the Cybersecurity and Infrastructure Security Agency Known Exploited Vulnerabilities database lists zero CVEs for the service at this time.

    Why it matters

    Cloud-based artificial intelligence platforms represent high-value targets for privilege escalation attacks due to their centralized infrastructure and broad network access. Fixing these vulnerabilities on the server side removes the patch management burden from users, reducing potential windows of exposure. This security action follows separate updates issued by SonicWall for four vulnerabilities affecting SMA1000 appliances.

    What is confirmed

    • Microsoft scored CVE-2026-85889 for missing authentication in Azure AI Foundry at CVSS 10.0.
    • CVE-2026-108456 involves server-side request forgery in Azure AI Foundry allowing privilege elevation.
    • The vulnerabilities were fixed server-side with no customer patching required.

    What to watch next

    • Any updates regarding active exploitation in the CISA KEV database
    • Additional CVE disclosures related to the Azure AI Foundry platform
    Sources used for this update (3)
    1. www.orcarouter.ai — Azure AI Foundry's CVSS 10.0 auth flaw, fixed server-side
    2. cvefeed.io — CVE-2026-108456 - Azure AI Foundry Elevation of Privilege ...
    3. premierepc.com — CVE-2026-108456: Azure AI Foundry Elevation of Privilege ...
    confidence 100%

  3. Microsoft Resolves Azure AI Foundry CVSS 10.0 Flaw

    Microsoft patched a critical server-side flaw carrying a maximum CVSS score of 10.0 in the Azure AI Foundry platform that permitted unauthorized privilege escalation. Because the corporation implemented the mitigation directly on its servers, users do not need to perform manual installations. This security action follows separate updates issued by SonicWall for four vulnerabilities affecting SMA1000 appliances, which included a high-severity pre-authentication request forgery bug located in the WorkPlace portal. Microsoft Azure AI Foundry has five published CVEs with zero currently listed in the CISA KEV database.

    Why it matters

    AI platforms and frameworks remain prime targets for malicious actors seeking credential exposure and privilege escalation. Security teams monitor third-party registries and developer tools closely following recent supply chain incidents such as poisoned software releases on PyPI and Docker. Proper vulnerability management requires tracking CVE severity scores and emergency patches applied directly by cloud vendors.

    What is confirmed

    • Microsoft resolved a critical server-side flaw in the Azure AI Foundry platform that permitted unauthorized privilege escalation with a maximum CVSS score of 10.0.
    • Users are not required to perform manual installations because the corporation implemented the mitigation directly on its servers.
    • SonicWall issued separate updates for four vulnerabilities affecting SMA1000 appliances, which included a high-severity pre-authentication request forgery bug located in the WorkPlace portal.
    • Microsoft Azure AI Foundry has five published CVEs, zero in CISA KEV, and zero with public exploits.

    What to watch next

    • Any new CVE additions or CISA KEV listings for Microsoft Azure AI Foundry vulnerabilities
    • Further advisories regarding AI platform supply chain security and credential exposure incidents
    Sources used for this update (5)
    1. support.microsoft.com — Contact Microsoft customer support | Microsoft Support
    2. www.pointguardai.com — AI Security Incident Tracker
    3. radicalnotion.ai — Microsoft Azure AI Foundry Vulnerabilities: CVEs, CISA KEV ...
    4. www.strix.ai — CVE Vulnerability Database — Search & Browse All CVEs - Strix
    5. infosecnexus.com — Live Cybersecurity Brief for October 24, 2026: Active Threats ...
    confidence 100%

  4. Microsoft Fixes Maximum-Severity Azure AI Foundry Vulnerability

    Microsoft has resolved a critical server-side flaw in the Azure AI Foundry platform that permitted unauthorized privilege escalation, carrying a maximum CVSS score of 10.0. Because the corporation implemented the mitigation directly on its servers, users are not required to perform manual installations. This security action follows separate updates issued by SonicWall for four vulnerabilities affecting SMA1000 appliances, which included a high-severity pre-authentication request forgery bug located in the WorkPlace portal.

    Why it matters

    Security teams continuously monitor cloud platforms and enterprise appliances to prevent unauthorized access and privilege escalation. Flaws with maximum severity ratings require immediate server-side mitigation to protect user environments from exploitation.

    Still unconfirmed

    • Microsoft 365 includes Word, Excel, PowerPoint, Outlook, Teams, and OneDrive with built-in Copilot features.

    What to watch next

    • Further official Microsoft security advisories regarding cloud platform mitigations.
    • Additional SonicWall updates for enterprise network appliances.
    Sources used for this update (3)
    1. support.microsoft.com — Sign in to Microsoft 365
    2. m365.cloud.microsoft — Microsoft 365 - Sign into Copilot
    3. www.microsoft.com — Microsoft Store - Deals on Laptops, Windows Computers & Other...
    confidence 40%

  5. Microsoft Patches Azure AI Foundry Vulnerability

    Microsoft has resolved a critical authentication issue in Azure AI Foundry, an artificial intelligence agent platform. The fix targets a server-side flaw carrying a maximum CVSS score of 10.0 that permitted unauthorized privilege escalation. Because Microsoft applied the mitigation directly to its servers, users do not need to install updates manually. This action follows separate security patches from SonicWall addressing four vulnerabilities in SMA1000 appliances, including a high-severity pre-authentication request forgery bug in the WorkPlace portal.

    Why it matters

    Securing cloud platforms and artificial intelligence agent infrastructure is a primary operational priority as enterprises adopt automated workloads. The mitigation of server-side authentication flaws prevents attackers from gaining unauthorized administrative control over sensitive environments. Vendors continue to audit platform services and edge appliances to prevent potential compromise of enterprise networks.

    What is confirmed

    • Microsoft mitigated a server-side authentication flaw in Azure AI Foundry.
    • The addressed vulnerability carries a maximum CVSS score of 10.0.
    • SonicWall issued hotfixes for four security issues in SMA1000 appliances.

    What to watch next

    • Confirmation of whether threat actors attempted exploitation prior to the server-side fix
    • Additional security advisories regarding Azure AI Foundry platform services
    Sources used for this update (5)
    1. apps.microsoft.com — Microsoft Store - Download apps, games & more for your Windows PC
    2. www.microsoft.com — Download Drivers & Updates for Microsoft, Windows and more -...
    3. rewards.bing.com — About – Microsoft Rewards
    4. learn.microsoft.com — Secure Azure platform services (PaaS) for AI
    5. www.cyber-defence.io — CVE Explorer — every CVE with CVSS, EPSS and CISA KEV in one ...
    confidence 100%

  6. Critical Azure AI Foundry and SonicWall Flaws Rated CVSS 10.0

    Microsoft and SonicWall have addressed separate critical vulnerabilities carrying maximum CVSS scores of 10.0. Microsoft mitigated a server-side authentication flaw in Azure AI Foundry affecting its artificial intelligence agent platform without requiring a user installation. Meanwhile, SonicWall issued hotfixes for four security issues in SMA1000 appliances, highlighted by a pre-authentication server-side request forgery bug tracked as CVE-2026-102255 in the WorkPlace portal. SonicWall reports no evidence of active exploitation for its newly patched vulnerabilities.

    Why it matters

    The disclosure of multiple top-severity vulnerabilities highlights ongoing security challenges across remote access gateways and enterprise artificial intelligence ecosystems. While the Azure AI Foundry issue required no client-side action due to server-side mitigation, the SMA1000 flaws demand immediate hotfix deployments to protect internal network functions.

    What is confirmed

    • SonicWall released hotfixes for four flaws in its SMA1000 appliances.
    • CVE-2026-102255 is a pre-authentication server-side request forgery bug in WorkPlace.
    • SonicWall states it has no evidence that any of the four SMA1000 flaws are being used in attacks.
    • Microsoft mitigated a server-side authentication flaw in its AI agent platform.

    Still unconfirmed

    • Cloud providers have failed to answer critical user questions regarding the CVE-2026-85889 mitigation.

    What to watch next

    • Verification of patch status across organizations utilizing SonicWall SMA1000 gateways
    • Further cloud provider disclosures regarding Azure AI Foundry security controls
    Sources used for this update (6)
    1. thehackernews.com — SonicWall Patches CVSS 10.0 Pre-Authentication SSRF Flaw in SMA1000 Appliances
    2. hivek.tech — CVE-2026-85889: la falla de CVSS 10 en Azure AI Foundry y las ...
    3. app.opencve.io — Microsoft CVEs and Security Vulnerabilities - OpenCVE
    4. app.opencve.io — CVEs and Security Vulnerabilities - OpenCVE
    5. www.innovationnetworkdesign.com — AI Service Identity Monitoring for SMBs | Innovation ND
    6. security-resilience.ai — Daily CVE Tracker | Cyber Resilience
    confidence 100%

  7. Microsoft Patches CVSS 10.0 Azure AI Foundry Flaw

    Microsoft has released a patch for CVE-2026-85889, a critical security vulnerability in Azure AI Foundry that carries a maximum CVSS score of 10.0. The flaw permits unauthorized privilege escalation, allowing attackers or unauthorized users to bypass intended security controls within the artificial intelligence ecosystem. Administrators must immediately apply the update to secure cloud infrastructure and artificial intelligence assets. Security monitoring platforms are tracking the issue to assist organizations in verifying their patch status.

    Why it matters

    Headquartered in Redmond, Washington, Microsoft Corporation is a major American multinational technology company founded in 1975 by Bill Gates and Paul Allen. Originally known for personal computer software like MS-DOS and Windows, the company has significantly expanded into cloud computing and artificial intelligence services. Vulnerabilities in core cloud ecosystems such as Azure AI Foundry pose severe risks to enterprise environments relying on integrated artificial intelligence infrastructure.

    What is confirmed

    • Microsoft Corporation is an American multinational technology company headquartered in Redmond, Washington.
    • The company was founded in 1975 by Bill Gates and Paul Allen.

    What to watch next

    • Deployment rates of the CVE-2026-85889 patch across enterprise Azure AI Foundry environments
    • Advisory updates from security monitoring platforms regarding active exploitation attempts
    Sources used for this update (3)
    1. account.microsoft.com — Microsoft account | Sign In or Create Your Account Today ...
    2. en.wikipedia.org — Microsoft - Wikipedia
    3. support.microsoft.com — Microsoft Support
    confidence 90%

  8. Microsoft patches CVE-2026-85889 privilege escalation flaw in Azure AI Foundry

    Microsoft has released a patch for CVE-2026-85889, a critical vulnerability in Azure AI Foundry that allows unauthorized privilege escalation. The flaw is rated with a CVSS score of 10.0. Administrators must apply the update to secure cloud and artificial intelligence infrastructure from exploitation. The vulnerability specifically impacts environments where unauthorized users could gain elevated permissions, bypassing intended security controls within the AI Foundry ecosystem. Security monitoring platforms are currently tracking the vulnerability to assist organizations in verifying their patch status and protecting cloud assets.

    Why it matters

    Azure AI Foundry utilizes toolbox authentication via OAuth or Microsoft Entra to manage per-user access and isolate authentication from agent code. A privilege escalation flaw in this environment could allow attackers to bypass these identity controls. Securing these gateways is essential to prevent unauthorized access to AI agents and underlying data.

    What is confirmed

    • Microsoft patched a privilege escalation vulnerability in Azure AI Foundry tracked as CVE-2026-85889.
    • The vulnerability CVE-2026-85889 carries a CVSS score of 10.0.
    • Azure AI Foundry supports per-user access through Microsoft Entra or OAuth to keep authentication out of agent code.

    What to watch next

    • Reports of active exploitation in the wild
    • Confirmation of affected Azure AI Foundry version numbers
    Sources used for this update (3)
    1. al-ice.ai — al-ice.ai — latest AI signal
    2. www.thehackerwire.com — Critical CVEs - Last 7 Days - TheHackerWire
    3. learn.microsoft.com — Toolbox authentication in Microsoft Foundry - Microsoft Foundry
    confidence 100%

  9. Microsoft Patches Critical Azure AI Foundry Security Vulnerability

    Microsoft addressed a serious security vulnerability in Azure AI Foundry tracked as CVE-2026-85889. The flaw carries a severity score, though sources differ on the exact metric, with reports noting a CVSS score of 9.8 alongside previous indications of a maximum-severity rating. Security monitoring platforms track actively exploited vulnerabilities alongside official vendor patches to help administrators protect cloud environments. Organizations must review security dashboards and apply these updates to prevent potential unauthorized privilege escalation across cloud and artificial intelligence infrastructure.

    Why it matters

    Cloud security teams face heightened risks as artificial intelligence platforms become integrated into enterprise networks. Prompt application of vendor patches prevents unauthorized access to sensitive environments. Administrators rely on centralized CVE tracking systems to prioritize critical updates.

    What is confirmed

    • Microsoft addressed the Azure AI Foundry security flaw tracked as CVE-2026-85889.

    Still unconfirmed

    • The vulnerability carries a CVSS 3.1 score of 9.8 and is accessible over the network without privileges or user interaction according to NeoTeo.

    What to watch next

    • Official confirmation of the exact CVSS score and vector details from Microsoft security advisories.
    • Updates to the CISA Known Exploited Vulnerabilities catalog regarding CVE-2026-85889.
    Sources used for this update (2)
    1. www.neoteo.com — Vulnerabilidad de Azure AI Foundry: CVE-2026-85889 | NeoTeo
    2. senserva.com — Microsoft CVE List (October 2026): Exploit-Ranked, Free ...
    confidence 90%

  10. Microsoft Patches Critical Azure AI Foundry Privilege Escalation Flaw

    Microsoft addressed a maximum-severity vulnerability in Azure AI Foundry identified as CVE-2026-85889, which allowed unauthorized privilege escalation. Researcher Rémy Marot discovered the security issue, prompting a broader update that fixes 18 distinct vulnerabilities across Microsoft cloud and artificial intelligence products. Security monitoring platforms integrated these updates to track actively exploited Common Vulnerabilities and Exposures alongside official patches from the software vendor. Administrators are advised to review security dashboards and prioritize these fixes to protect vulnerable cloud environments from potential compromise.

    Why it matters

    This security advisory arrives amid heightened enterprise reliance on cloud-based artificial intelligence infrastructure, making foundational platform flaws high-risk targets for attackers. The inclusion of CVE-2026-85889 in a multi-product update underscores the expanding surface area of enterprise AI deployments. Security teams use intelligence feeds to map these patches against active threats tracked in official vulnerability catalogs.

    What is confirmed

    • Microsoft patched a CVSS 10.0 vulnerability in Azure AI Foundry enabling unauthorized privilege escalation.
    • The vulnerability is designated as CVE-2026-85889 and was discovered by Rémy Marot.
    • The patch is part of a broader security release addressing 18 vulnerabilities in Microsoft AI and cloud products.

    Still unconfirmed

    • Senserva Watch Live monitors exploited CVEs and patches twice a day.

    What to watch next

    • Integration of CVE-2026-85889 into the CISA Known Exploited Vulnerabilities catalog
    • Vendor advisories regarding active exploitation in the wild
    Sources used for this update (2)
    1. senserva.com — Senserva Watch Live: Exploited CVEs, Microsoft Patches, and ...
    2. app.opencve.io — Azure CVEs and Security Vulnerabilities - OpenCVE
    confidence 100%

  11. Microsoft Patches CVSS 10.0 Azure AI Foundry Flaw

    Microsoft patched a CVSS 10.0 vulnerability in Azure AI Foundry, enabling unauthorized privilege escalation. The flaw, CVE-2026-85889, was discovered by Rémy Marot and is part of a broader security release addressing 18 vulnerabilities in Microsoft AI and cloud products.

    Why it matters

    This update is part of a massive Microsoft security cycle that plugs nearly 1,000 security holes across various products. The September CVE cluster for Azure has also expanded to cover additional issues in PostgreSQL and billing systems.

    What is confirmed

    • CVE-2026-85889 has a maximum-severity CVSS score of 10.0.
    • The vulnerability was discovered by Rémy Marot.
    • Microsoft patched the flaw server-side in mid-September 2026.
    • CVE-2026-85889 is an authentication bypass in Azure AI Foundry.

    Still unconfirmed

    • No customer notification or audit trail was provided for the mitigation.

    What to watch next

    • Further details on the 18 vulnerabilities addressed in the broader security release
    • Microsoft's handling of similar CVSS 10.0 flaws in other products
    • Exploitation attempts of CVE-2026-85889 in the wild
    Sources used for this update (7)
    1. tech.yahoo.com — Azure AI Foundry Had a CVSS 10.0 Authentication Bypass ...
    2. shattered.io — Azure AI Foundry CVSS 10 Flaw: No Patch Needed [2026]
    3. forkast.news — Azure AI Foundry Had a CVSS 10.0 Authentication Bypass ...
    4. security.glexia.com — CVE-2026-85889: Microsoft Azure AI Foundry vulnerability | Glexia
    5. www.neoteo.com — Azure AI Foundry vulnerability reportedly mitigated | NeoTeo
    6. securitydaily.news — SecurityDaily.news — Cybersecurity News & Threat Intelligence
    7. senserva.com — Microsoft Patch Tracker (September 2026): Exploit-Ranked ...
    confidence 100%

  12. Microsoft Patches CVSS 10.0 Azure AI Foundry Flaw

    Microsoft has patched a critical CVSS 10.0 vulnerability in Azure AI Foundry that allowed unauthorized privilege escalation. This update is part of a broader security release that addresses 18 total vulnerabilities spanning Microsoft AI and cloud products. The September CVE cluster for Azure has also expanded to cover additional issues in PostgreSQL and billing systems. These developments arrive as part of a massive Microsoft security cycle that plugs nearly 1,000 security holes across various products, alongside separate warnings regarding FortiOS, PAN-OS flaws, and a Revolut data breach.

    Why it matters

    Cloud security architecture depends heavily on strict isolation between user permissions and infrastructure control. Critical flaws in AI foundry services present severe risks due to the deep integration of cloud tools and enterprise data. Security teams must rapidly deploy these patches to prevent potential privilege escalation attacks across vulnerable Azure deployments.

    What is confirmed

    • Microsoft patched a CVSS 10.0 Azure AI Foundry flaw enabling unauthorized privilege escalation.
    • Microsoft patched 18 vulnerabilities in AI and cloud products.
    • Azure's September CVE cluster now covers PostgreSQL and billing.

    Still unconfirmed

    • A Microsoft 0-day vulnerability is connected to the recent cybersecurity newsletter bulletin alongside FortiOS, PAN-OS flaws, and a Revolut data breach.

    What to watch next

    • Technical disclosures detailing how the Azure AI Foundry privilege escalation vulnerability could be exploited
    • Confirmation of whether the PostgreSQL and billing CVEs have been actively targeted in the wild
    Sources used for this update (5)
    1. The Hacker News — Microsoft Patches CVSS 10.0 Azure AI Foundry Flaw Enabling Unauthorized Privilege Escalation
    2. securityweek.com — Microsoft Patches 18 Vulnerabilities in AI, Cloud Products
    3. forkast.news — The Fault Line Spreads: Azure’s September CVE Cluster Now Covers PostgreSQL and Billing
    4. CyberSecurityNews — Weekly Cybersecurity Newsletter Bulletin – Microsoft 0-day, FortiOS, PAN-OS Flaw, Revolut Data Breach, and...
    5. Adafruit — Microsoft plugs nearly 1,000 security holes – Krebs on Security
    confidence 100%
📊

Community Sentiment: How do you assess this situation?

Voice your perspective · Real-time aggregated sentiment from the Live Feeds community