Azure AI Foundry Authentication Failure Earns Maximum-Severity CVSS Rating

Microsoft has fixed a critical authentication failure in Azure AI Foundry that could allow an unauthenticated remote attacker to gain elevated privileges. The cloud vulnerability, CVE-2026-85889, carries a maximum CVSS v3.1 base score of 10.0.

The company says it has already mitigated the flaw within the hosted service. Customers do not need to install an update, change configurations, or apply a workaround.

Microsoft also disclosed a critical command-injection vulnerability in Microsoft 365 Copilot. Two further cloud privilege-escalation issues were reported in Azure Database for PostgreSQL and Azure Cosmos DB, while separate Windows flaws require closer attention from administrators.

As of September 18, 2026, Microsoft reports no known exploitation or public proof-of-concept code for the Azure AI Foundry and Copilot vulnerabilities.

Missing authentication exposed a critical Foundry function

Azure AI Foundry, also called Microsoft Foundry, is an enterprise platform used to build, deploy, and manage generative-AI applications and agents. CVE-2026-85889 resulted from missing authentication for a critical function within that platform.

The vulnerability’s CVSS vector is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C

An attacker could reach the vulnerable function over a network, with low attack complexity, without holding an account or persuading a user to take action. Successful exploitation could have a high impact on confidentiality, integrity, and availability.

The vector also assigns “changed” scope. That means exploitation could cross the vulnerable component’s original security boundary and affect resources governed by another security authority. Microsoft classifies the resulting impact as elevation of privilege.

The 10.0 figure is the base score. Microsoft’s advisory also displays a temporal score of 8.7, reflecting unproven exploit maturity, an official fix, and confirmed reporting. Microsoft has not assigned a CWE identifier in the published record.

Security researcher Rémy Marot, known as @R_Marot, reported the vulnerability. According to Microsoft’s CVE-2026-85889 advisory, it was neither publicly disclosed nor exploited. No public exploit code is known, and Microsoft lists the exploitability assessment as “N/A.”

The fix was deployed by Microsoft, not its customers

Because Azure AI Foundry is a cloud-hosted service, remediation did not follow the usual endpoint-patching model. Microsoft changed the service itself and then published the CVE to document the security defect.

The company describes CVE-2026-85889 as fully mitigated. There is no downloadable patch, customer-side workaround, or affected-version list.

That last point limits external exposure analysis. Organizations cannot compare a local Foundry build against vulnerable and fixed versions because Microsoft has not disclosed such versions. They can, however, record the CVE in internal risk registers and verify that security or compliance teams do not create unnecessary emergency deployment work for a server-side correction.

Microsoft has provided no hashes, network indicators, log patterns, or exploit artifacts associated with the flaw. There is consequently no vulnerability-specific hunting query available from the disclosed information.

No evidence currently indicates exploitation in the wild. The absence of customer action should not be confused with a low-impact bug: the maximum base score reflects what an attacker could achieve before Microsoft’s server-side mitigation.

Microsoft 365 Copilot had a separate command-injection path

The second major cloud disclosure concerns CVE-2026-85885, a command-injection vulnerability in Microsoft 365 Copilot. Microsoft rates it critical, with a CVSS v3.1 base score of 9.9 and a temporal score of 8.6.

Its vector is:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C

Unlike the Foundry flaw, an attacker must already possess low-level authorization. The attack remains network-accessible, has low complexity, and requires no interaction from another user.

The weakness involves improper handling of special elements used in a command. That condition could let an attacker inject command content and elevate privileges beyond the access initially granted. Microsoft does not provide a CWE identifier, but it identifies command injection as the underlying vulnerability class.

Changed scope and high impact across confidentiality, integrity, and availability account for the near-maximum score. A researcher identified only as Alex received credit for reporting the issue.

Microsoft says the Copilot vulnerability was not publicly disclosed or exploited, and no public exploit code has been reported. It has been fully mitigated in the cloud, so customers have no update or workaround to apply.

PostgreSQL and Cosmos DB flaws expand the cloud disclosures

Separate reporting identifies two additional privilege-escalation vulnerabilities in Microsoft’s managed cloud products:

• CVE-2026-85878 affects Azure Database for PostgreSQL. It is an improper-authorization issue rated CVSS 9.9. A low-privileged attacker could attempt remote privilege escalation without user interaction.
• CVE-2026-87701 affects Azure Cosmos DB. The improper-neutralization vulnerability has a CVSS score of 9.6 and could allow an authorized network attacker to elevate privileges.

The respective vectors are:

• CVE-2026-85878: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
• CVE-2026-87701: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

The Cosmos DB issue differs by carrying no availability impact in its vector, while confidentiality and integrity impacts remain high.

Microsoft reportedly mitigated both vulnerabilities within the cloud services, with no customer action required. However, corresponding Microsoft Security Response Center records were not available for independent comparison. Exact affected service versions, technical exploitation sequences, public-disclosure status, and researcher acknowledgements are not known.

Windows flaws require version and update checks

The cloud fixes are automatic, but two Windows privilege-escalation vulnerabilities have different operational implications.

CVE-2026-62721 affects Windows User-Mode Power Service and can allow an authorized local attacker to obtain elevated privileges, potentially reaching SYSTEM. It is rated CVSS 7.8:

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The issue is classified as CWE-1220, insufficient granularity of access control. Affected versions listed in NVD include:

Product	Affected versions
Windows 10 1607	Below 10.0.14393.9418
Windows 10 1809	Below 10.0.17763.9115
Windows 10 21H2	Below 10.0.19044.7663
Windows 10 22H2	Below 10.0.19045.7663
Windows 11 23H2	Below 10.0.22631.7517
Windows 11 24H2	Below 10.0.26100.9106
Windows 11 25H2	Below 10.0.26200.9106
Windows 11 26H1	Below 10.0.28000.2704
Windows Server 2016	Below 10.0.14393.9418
Windows Server 2019	Below 10.0.17763.9115
Windows Server 2022	Below 10.0.20348.5440

Windows Server 2012 is also listed as affected, but no version threshold is available.

The second issue, CVE-2026-85921, is a double-free vulnerability in Windows Secure Kernel Mode. It could enable a highly privileged local attacker to reach Virtual Trust Level 1, or VTL1, privileges.

CVE-2026-85921 is classified as CWE-415 and rated CVSS 8.2:

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

An affected-product and version list has not been disclosed for this CVE. Both Windows issues were reportedly addressed for Windows 11 26H1 through the out-of-band KB5129194 cumulative update for arm64 and x64 systems, resulting in build 28000.2956.

What defenders should do now

Azure AI Foundry, Microsoft 365 Copilot, Azure Database for PostgreSQL, and Azure Cosmos DB customers do not need to deploy fixes for these disclosures. Microsoft has handled the reported cloud remediation.

Windows administrators should take concrete action:

1. Deploy KB5129194 to Windows 11 26H1 arm64 and x64 systems where applicable.
2. Confirm that installations reach build 28000.2956.
3. Compare Windows 10, Windows 11, and Windows Server builds against the published CVE-2026-62721 thresholds.
4. Monitor local privilege-escalation activity that attempts to obtain SYSTEM or VTL1 access.

No specific exploit samples, file hashes, or network indicators are available for either Windows flaw.

CISA Known Exploited Vulnerabilities catalog status and remediation deadlines cannot be confirmed for CVE-2026-85889, CVE-2026-85885, CVE-2026-85878, CVE-2026-87701, CVE-2026-62721, or CVE-2026-85921. Microsoft has nevertheless had several other vulnerabilities enter KEV recently: CVE-2026-85880 and CVE-2026-81963 on September 8, 2026; CVE-2019-1068 on August 26, 2026; CVE-2026-55040 and CVE-2026-33824 on August 18, 2026; and CVE-2026-68820 on August 11, 2026.

For the vulnerabilities discussed here, the available evidence supports prioritizing Windows build verification while documenting—rather than attempting to patch—the cloud-service issues already remediated by Microsoft.