Reported by 6 outlets
CVE-2026-85889 | CRITICAL flaw in Azure AI Foundry: missing authentication for a critical function (CVSS 10) allows remote privilege escalat
Why this score
- Breadth
- 2.00 / 2.0 · 6 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 4.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.32 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Analysis
CVE-2026-85889 hits Azure AI Foundry with a CVSS 10.0 score: missing authentication for a critical function allows remote privilege escalation. Multiple sources (radar.offseq, Microsoft MSRC, The Hacker News) confirm the flaw affects the AI Foundry service. The issue is a missing-authentication bug, not a remote-code path, but at CVSS 10 the exposure is total for any accessible instance. Watch for Microsoft patch timelines and whether attackers scan for exposed Foundry endpoints.
Timeline
-
original reporting
CVE-2026-85889 | CRITICAL flaw in Azure AI Foundry: missing authentication for a critical function (CVSS 10) allows remote privilege escalat
radar.offseq.com · 26d ago · September 18th, 2026
CVE-2026-85889 | CRITICAL flaw in Azure AI Foundry: missing authentication for a critical function (CVSS 10) allows remote privilege escalat
via Mastodon https://radar.offseq.com/threat/cve-2026-85889-cwe-306-missing-authentication-for-critical-function-in-microsoft-azure-ai-foundry-e4d903ee0861658f
-
update from thehackernews.com
🤖 CVE-2026-85889 (CVSS 10.0): missing authentication for a critical function in Microsoft Azure AI Foundry lets an unauthenticated attacker
thehackernews.com · 25d ago · September 18th, 2026
🤖 CVE-2026-85889 (CVSS 10.0): missing authentication for a critical function in Microsoft Azure AI Foundry lets an unauthenticated attacker
via Mastodon https://thehackernews.com/2026/09/microsoft-patches-cvss-100-azure-ai.html
-
update from msrc.microsoft.com
If you missed this, Microsoft patched this vulnerability yesterday: CVE-2026-85889: Azure AI Foundry Elevation of Privilege Vulnerability (n
msrc.microsoft.com · 25d ago · September 18th, 2026
If you missed this, Microsoft patched this vulnerability yesterday: CVE-2026-85889: Azure AI Foundry Elevation of Privilege Vulnerability (n
via Mastodon https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85889
-
update from cyberwald.com
Cyberwald - Cybersecurity News - 19.09.2026 Today in the podcast: Brevo API key leak distributes ClickFix malware across 100,000 websites. Microsoft patches critical Azure AI Foundry flaw (CVE-2026-85889, CVSS 10).
cyberwald.com · 24d ago · September 19th, 2026
Cyberwald - Cybersecurity News - 19.09.2026 Today in the podcast: Brevo API key leak distributes ClickFix malware across 100,000 websites.
-
update from beyondmachines.net
Microsoft Fixes Maximum-Severity Azure AI Foundry Flaw and Critical Cloud Vulnerabilities Microsoft patched a CVSS 10.0 vulnerability in Azu
beyondmachines.net · 24d ago · September 19th, 2026
Microsoft Fixes Maximum-Severity Azure AI Foundry Flaw and Critical Cloud Vulnerabilities Microsoft patched a CVSS 10.0 vulnerability in Azu
via Mastodon https://beyondmachines.net/event_details/microsoft-fixes-maximum-severity-azure-ai-foundry-flaw-and-critical-cloud-vulnerabilities-y-z-r-h-h/gD2P6Ple2L
-
update from thehackernews.com
Reward: You've been awarded the Compliance Participation Ribbon. It does not stack. https:// thehackernews.com/2026/09/micr osoft-patches-cv
thehackernews.com · 23d ago · September 20th, 2026
Reward: You've been awarded the Compliance Participation Ribbon. It does not stack.
-
mentioned by cybersecurefox.com
CVE-2026-85889: CVSS 10.0 vulnerability in Azure AI Foundry 🔗 https:// cybersecurefox.com/en/cve-2026 -85889-azure-ai-foundry-cvss-10-privil
cybersecurefox.com · 20d ago · September 23rd, 2026