Azure AI Foundry maximum-severity flaw patched by Microsoft, 10.0

Microsoft has released a fix for a maximum-severity flaw in Azure AI Foundry, the company's platform for building, deploying and managing generative AI applications and agents. The vulnerability is tracked as CVE-2026-85889 and carries a CVSS score of 10.0, the top of the Common Vulnerability Scoring System, a scale from 0 to 10 that describes how serious a software flaw is. According to Microsoft's advisory, published on a Thursday, the problem was a missing authentication for a critical function, which would allow an unauthorized attacker to elevate privileges over a network. The company said no customer action is required, and that there is no evidence the issue has been exploited in the wild. Microsoft credited the security researcher Rémy Marot (@R_Marot) with discovering and reporting the flaw.

Two pieces of jargon carry most of the meaning here. Authentication is the step where a system checks who you are before letting you use something, usually with a password, a key or a token, so a missing authentication check means that door was left open for a function important enough that Microsoft calls it critical. Privilege escalation is the term for gaining a level of access an account was never meant to have. In a cloud service such as Azure AI Foundry, which Microsoft hosts and operates rather than customers installing it on their own machines, the correction happens on the provider's side, which is why the company can state that users have nothing to install. The same logic covers the AI agents and applications that organisations build on top of the platform: the underlying service is patched centrally.

Three other cloud issues were fixed in the same round, all of them also already mitigated on Microsoft's side. CVE-2026-85885, rated 9.9, is a command injection vulnerability in Microsoft 365 Copilot that the advisory says could allow an authorized attacker to elevate privileges over a network, and command injection means getting a program to run instructions it was never intended to run. CVE-2026-85878, also 9.9, is an improper authorization in the Azure-hosted open-source relational database service, a class of bug where the service does not correctly decide whether a user is allowed to perform an action. CVE-2026-87701, rated 9.6, is described as improper neutralization in Azure Cosmos DB, the family of flaws where untrusted input is not cleaned up properly before the software makes use of it. Microsoft said, as is typically the case with cloud-based CVEs, that these vulnerabilities have already been fully mitigated and require no action from users.

Two further flaws did need something from customers, because they affect software running on Windows machines rather than on Microsoft's own infrastructure. CVE-2026-62721, with a CVSS score of 7.8, is an insufficient granularity of access control in the Windows User-Mode Power Service (UMPS), which means the permission model was not detailed enough to stop an authorized attacker from elevating privileges locally and reaching SYSTEM privileges, the highest level of access on a Windows system. CVE-2026-85921, rated 8.2, is a double free vulnerability in Windows Secure Kernel Mode; a double free happens when a program releases the same block of memory twice, which can corrupt the software and create an opening for an attack. Microsoft says it could allow an authorized attacker to elevate privileges locally and gain Virtual Trust Level 1 (VTL1) privileges, a protected layer inside Windows that normally keeps sensitive code separated from the rest of the system. Both are local flaws, meaning an attacker must already have some access to the machine, in contrast with the network-reachable cloud bugs described above.

Microsoft delivered those two Windows fixes as an out-of-band update for Windows 11, version 26H1, which means it was published outside the usual monthly patch cycle. It appears as the 2026-09 Cumulative Update for Windows 11, version 26H1, listed as KB5129194 (28000.2956), in one version for arm64-based systems and another for x64-based systems. The source does not say which of the two flaws prompted the out-of-band release; it notes only that one of the vulnerabilities was originally disclosed last month.

The patches land in a busy month for Microsoft. The company fixed a record 974 vulnerabilities across its software portfolio earlier last week, and two of those, affecting Windows Advanced Local Procedure Call (ALPC) and the Windows Update Stack, have come under active exploitation. Reports from Proofpoint and Volexity describe the ALPC flaw as having been chained together with two Google Chrome flaws into an exploit kit called BlueMoon, which has been weaponized by multiple espionage-aligned threat actors to deliver malicious payloads. Those findings belong to Proofpoint and Volexity, as described in that reporting.

For website owners, IT teams and businesses, the split between the two groups of vulnerabilities is the most useful takeaway. Cloud services patch themselves, so the work there is awareness: know which platforms your organisation relies on and follow the vendor advisories for them. Anything running on your own computers, including Windows laptops and desktops, receives its fix only when someone installs it, and an out-of-band update is easy to miss precisely because it does not arrive on the familiar monthly date. Machines left unpatched stay exposed, and the reported attack chain also involved Chrome flaws, so browser updates deserve the same attention. Teams that would rather not track vendor advisories one by one can see what security-first IT, infrastructure and consulting covers on the AEU-I service page. On the most serious item, CVE-2026-85889, Microsoft's position is that the fix is already in place and that users need to do nothing.