Microsoft fixes a perfect-10 flaw in Azure AI Foundry that let strangers take control
A missing authentication check in Microsoft's flagship AI development platform earned the rare CVSS 10.0 rating. Microsoft patched it on its side, but the bug says a lot about how fast AI services are shipping.
Key points
- Microsoft patched CVE-2026-85889 in Azure AI Foundry on 17 September 2026, a flaw rated 10.0 out of 10 on the industry severity scale.
- The bug was a missing authentication check on a critical function, meaning an outsider on the network could gain higher privileges without a password.
- Microsoft says no customer action is required because the fix was applied in its own cloud, not in software customers install.
- Foundry is the platform Microsoft is pushing enterprises to use for building and running AI agents, tying together Azure Machine Learning, Foundry Agent Service, Foundry Models and the rest of the stack.
- The advisory does not say whether anyone exploited the flaw before the patch, and Microsoft has published no indicators customers can hunt for.
Microsoft has quietly closed a hole in Azure AI Foundry, its main platform for building and running AI applications, that was as bad as this kind of bug gets.
The flaw is tracked as CVE-2026-85889 and scores a 10.0 on the Common Vulnerability Scoring System, the industry ruler that runs from 0 to 10. Perfect tens are rare. They mean the bug can be triggered from the network, needs no login, and puts meaningful control in an attacker's hands.
This one qualifies. A critical function inside Foundry was missing an authentication check, so an unauthorised attacker on the network could raise their own privileges. A stranger who could reach the service could act as if they were a more trusted user.
What is Azure AI Foundry?
Foundry is Microsoft's rebranded and expanded AI development platform, formerly called Azure AI Studio. It's where companies wire up AI models, agents and private data.
Microsoft's own description lists a long menu of services stitched into it: Foundry Models, Foundry Agent Service, Foundry Tools, Foundry IQ (the successor to Azure AI Search), Azure Machine Learning, the Foundry Control Plane and a local edition called Foundry Local. Alongside those sit Azure App Service, Container Apps, Functions, Cosmos DB, PostgreSQL and Managed Redis, plus Microsoft's own knowledge sources.
That matters because a privilege bug in the control plane of something this connected isn't a bug in one product. It sits next to a lot of customer data and a lot of customer code. We covered the wider September patch release in our story Microsoft's Biggest-Ever Security Update Fixes 974 Flaws, Two Already Used in Attacks from the same day, which gives useful context for how much Microsoft was pushing out at once.
Do customers need to do anything?
No, according to Microsoft. The fix was applied inside Azure itself, so there's no patch to download and no version number for admins to chase.
That's the upside of a managed cloud service. Customers have no way to verify the fix, no build number to check against, and so far no indicators of compromise to hunt through their logs. The advisory, first reported by The Hacker News, doesn't say whether the flaw was found by an outside researcher or internally, and it doesn't say whether anyone abused it before the patch went in.
If you run workloads in Foundry, the useful move this week is to pull your Azure activity logs for the platform and review anything odd from before 17 September: unexpected role assignments, new service principals, agent deployments you didn't authorise. Not because Microsoft has told you to. Because they haven't told you not to.
Should you worry about the 10.0 rating?
A 10.0 is the scoring system's way of saying every dial is at worst case. No authentication, network reachable, high impact on confidentiality and availability. For a platform Microsoft is actively selling as the place to build enterprise AI agents, that's an uncomfortable rating to ship with, even briefly.
Whatever the post-mortem eventually says, a critical function was exposed without an auth check. That's a class of bug the industry has known how to prevent for twenty years. It keeps appearing in new AI services because those services are being built at speed, on top of stacks of other services, by teams shipping first and threat-modelling second. Foundry is a poster child for that pattern: it's not one product, it's a dozen Azure services glued together under a new brand, and the seams are showing.
Audit who and what has permissions inside Foundry now. This story didn't end when Microsoft pushed the fix.
