Microsoft Patches CVSS 10.0 Azure AI Foundry Auth Bypass

Picture a bank vault with the thickest door in the industry, biometrics, mantraps, the lot. Now picture the architects forgot to install a lock on the back door where the cleaners come in. That, roughly, is what Rémy Marot found in Azure AI Foundry: the front of the building looked immaculate, and the tradesman's entrance was standing wide open.

Microsoft shipped a fix this week for a CVSS 10.0 flaw in its flagship enterprise AI platform, and it landed in the middle of the busiest patch cycle in the company's history. The vault metaphor is going to do a lot of work in the next thousand words, because there are a lot of unlocked doors to talk about.

What Happened

On Thursday, as The Hacker News reported, Microsoft published an advisory for CVE-2026-85889, a maximum-severity vulnerability in Azure AI Foundry, the platform it also markets as Microsoft Foundry for building, deploying, and managing generative AI applications and agents.

The description is short and unpleasant. "Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network." No credentials required. No user interaction. Over the network. That is the trifecta that pushes a CVSS score to 10.0, and it is exactly why the number exists.

Credit went to security researcher Rémy Marot, who reported the flaw privately. Microsoft says there is no evidence of exploitation in the wild, and because the fix lives on the cloud side, no customer action is required.

The Foundry bug didn't travel alone. Microsoft also disclosed CVE-2026-85885 (CVSS 9.9), a command injection in Microsoft 365 Copilot; CVE-2026-85878 (CVSS 9.9), an improper authorization flaw in Azure Database for PostgreSQL; and CVE-2026-87701 (CVSS 9.6), an improper neutralization bug in Azure Cosmos DB. All three allow an authorized attacker to elevate privileges over a network. All three have been mitigated server-side.

Two more got out-of-band Windows 11 26H1 patches (KB5129194, build 28000.2956): CVE-2026-62721 in the User-Mode Power Service, giving SYSTEM locally, and CVE-2026-85921, a double-free in Secure Kernel Mode granting VTL1 privileges, originally disclosed last month. All of this on top of the record 974 vulnerabilities Microsoft patched earlier last week, two of which, in Windows ALPC and the Windows Update Stack, are under active exploitation.

Technical Anatomy

"Missing authentication for critical function" is the sort of finding that makes senior engineers pinch the bridge of their nose. It is OWASP 101, the class of bug that has been on the top-ten list in one form or another since before Foundry's product managers were writing SQL. And it landed in a platform whose entire pitch is "trust us to run your agents in production."

Foundry sits at the intersection of everything scary in modern cloud: model endpoints, agent runtimes, tool-calling connectors, vector stores, and the customer data feeding all of it. The blast radius of a critical function exposed without auth in that stack isn't just "attacker gets into a service." It's potentially "attacker pivots into the control plane of every AI agent a tenant has deployed." We don't have the CVE's exploitation details, and Microsoft isn't publishing them, but that is the shape of the risk when the vulnerable component is described as a critical function.

The other cloud CVEs tell a consistent story. Command injection in Copilot means input handed to a shell-like context wasn't sanitised. Improper authorization in Postgres and improper neutralization in Cosmos DB both point at the boring bit, the part where you check whether the caller is actually allowed to do the thing they're asking for. Anyone who has debugged a multi-tenant authorization layer knows how easy it is to leave one code path uncovered while the other ninety-nine look bulletproof.

The Windows-side pair are more traditional. UMPS with insufficient access-control granularity is a classic local elevation to SYSTEM, and a double-free in Secure Kernel Mode giving VTL1 is the sort of thing that unpicks virtualization-based security. The BlueMoon exploit kit, reported by Proofpoint and Volexity, chains the ALPC flaw with two Chrome bugs. That is a browser-to-kernel chain being handed to multiple espionage-aligned actors, catalogued in the usual places like the CISA KEV list once dust settles. The lock on the vault is only as strong as the weakest hinge, and BlueMoon is a hinge-shopping operation.

Who Gets Burned

The Foundry disclosure is, on paper, the least painful of the lot. Cloud-mitigated, no customer action, no evidence of in-the-wild abuse. In practice, if you are a CTO or platform lead running production agents on Foundry, "no action required" is not the same as "nothing to think about." You have to assume some window existed where an unauthenticated attacker could reach that critical function, and you have no way, from the outside, to know how long that window was open or who looked through it.

For iGaming and fintech teams piloting Copilot integrations or Foundry-hosted agents against customer data, the risk model just shifted. The Copilot command injection is the one I would lose sleep over. Copilot is being wired into ticketing systems, CRM, internal knowledge bases, and increasingly into decision workflows. An authorized attacker elevating privileges through a prompt-fed injection sounds a lot like the insider-threat scenarios compliance teams have been waving at for a decade, except the "insider" is now anyone with access to a document Copilot ingests.

Ad-tech and enterprise data teams sitting on Cosmos DB or Azure PostgreSQL are in a similar boat. Mitigated at the platform, yes, but the audit question your board will ask next quarter is: "Did our tenant get touched between the vuln existing and Microsoft fixing it?" The honest answer is often "we don't know," and that answer plays badly in front of a regulator.

The Windows and ALPC crowd have a harder ninety days. BlueMoon is already in the hands of multiple espionage actors. Any enterprise fleet running unpatched Chrome and Windows is a target, and the exploit kit model means the barrier to entry keeps dropping as more crews license or copy it.

Playbook for Security Teams

Start with the assumption that "no customer action required" applies to the patch, not to your incident-response posture. Pull whatever Foundry, Copilot, Cosmos, and Azure Postgres audit logs you retain and go looking for anomalous privilege escalations, unusual service principal activity, or API calls to admin endpoints from unfamiliar sources. If your log retention is shorter than the disclosure window, that itself is a finding.

On the endpoint side, get KB5129194 deployed to Windows 11 26H1 fleets this week, not next sprint. If you run Chrome as your managed browser, verify your update channel is current and that end users aren't sitting on stale versions because of a pinned extension. BlueMoon is the kind of kit that finds the one laptop your MDM missed.

Map the exploitation chain against MITRE ATT&CK for your detection engineering team, particularly around initial access via browser, privilege escalation via ALPC abuse, and defence evasion inside VTL1. If you have a threat-hunting function, this is the week to task them.

Finally, use this cycle as ammunition internally. When someone in a planning meeting waves off authentication review as low priority because "the platform handles it," point at CVE-2026-85889. A CVSS 10.0 with the description "missing authentication for critical function" is the sort of receipt that ends architectural arguments.

Key Takeaways

• CVE-2026-85889 in Azure AI Foundry is a CVSS 10.0 unauthenticated network privilege escalation, fixed server-side with no customer action required.
• Microsoft also patched critical flaws in Microsoft 365 Copilot (9.9), Azure Database for PostgreSQL (9.9), and Azure Cosmos DB (9.6), all cloud-mitigated.
• Windows 11 26H1 got an out-of-band update (KB5129194) for a SYSTEM-level UMPS flaw and a VTL1 double-free in Secure Kernel Mode.
• The BlueMoon exploit kit, chaining an ALPC bug with two Chrome flaws, is already being used by multiple espionage-aligned actors according to Proofpoint and Volexity.
• Cloud-mitigated does not equal audit-complete: pull your Foundry, Copilot, and database logs and look for the window between vulnerability and fix.

The vault door is patched. The question every platform lead should be asking this quarter is how many other tradesman's entrances are sitting in the products they've already bet the business on.