On Thursday, September 17, 2026, Microsoft patched a maximum-severity, CVSS 10.0 flaw in Azure AI Foundry that let attackers escalate privileges remotely. The fix was one of 18 vulnerabilities Microsoft addressed across its Azure and Copilot lineup.
The Brief
- Microsoft closed a maximum-severity CVSS 10.0 flaw in Azure AI Foundry that let attackers escalate privileges without authentication.
- The company patched 18 vulnerabilities in total across its Azure, Copilot, and Dataverse product lines, per SecurityWeek’s count.
- The two Windows CVEs, unlike the cloud-side fixes, need a manual update, KB5129194, according to Microsoft, to close local privilege-escalation bugs reaching SYSTEM or kernel access.
- No evidence has surfaced that attackers exploited any of the newly patched flaws before the fix shipped, per TheHackerNews.
The Azure AI Foundry flaw, tracked as CVE-2026-85889, carries a maximum CVSS score of 10.0 for missing authentication on a critical function. Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network, Microsoft said in a Thursday advisory, according to TheHackerNews. The company credited researcher Rémy Marot (@R_Marot) for the discovery.
Azure AI Foundry, also known as Microsoft Foundry, is the company’s platform for building and deploying generative AI applications and agents. Microsoft found no evidence the flaw had been exploited before the patch shipped.
The fix was one of 18 vulnerabilities Microsoft patched this cycle, most of them elevation-of-privilege bugs. The affected products spanned Azure ARC, Azure AI Foundry, Azure Logic Apps, Azure Cosmos DB, Microsoft Fabric, Microsoft Dataverse, and Microsoft 365 Copilot.
The AI Foundry bug stands apart from the rest of the batch. It needed no prior access at all, unlike most of the others.
Several information-disclosure flaws were also fixed in Copilot and Azure Machine Learning, plus a single spoofing bug in Azure Portal. None of the 18 flaws were flagged as exploited. Microsoft said every fix was implemented server-side, meaning customers did not need to act.
CVE-2026-85917 Server-side request forgery (ssrf) in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network. https://t.co/7zGT38tvto
— CVE (@CVEnew) September 18, 2026
Windows still needs the KB5129194 update
Outside that batch of 18 sit two more Windows CVEs. CVE-2026-62721 (CVSS 7.8) and CVE-2026-85921 (CVSS 8.2) affect Windows and need a manual install instead of a server-side fix. Both reach affected machines through the same out-of-band cumulative update, KB5129194. That is unlike the automatic cloud-side patches Microsoft pushed for Azure AI Foundry and its other cloud products.
- CVE-2026-62721 exploits insufficient access-control granularity in the Windows User-Mode Power Service, letting a local attacker reach SYSTEM privileges.
- CVE-2026-85921 is a double free bug in Windows Secure Kernel Mode, letting a local attacker reach Virtual Trust Level 1.
Unlike the cloud-side fixes above, Microsoft said users do need to update Windows to resolve CVE-2026-85921. The company rated exploitation of that kernel flaw as less likely.
That distinction is the one both trade reports blur. An Azure-side CVSS 10.0 needed nothing from customers, while a lower-scored Windows bug still needs an administrator’s action.
What’s Next?
The disclosures follow Microsoft’s main patch cycle the previous week, which fixed a record 974 vulnerabilities across its software portfolio. Two of those defects, in Windows Advanced Local Procedure Call (ALPC) and the Windows Update Stack, are under active exploitation.
Proofpoint and Volexity reported the ALPC bug has been chained with two Google Chrome flaws into an exploit kit called BlueMoon. Multiple espionage-aligned threat actors have weaponized BlueMoon to deliver payloads. Watching which disclosed bugs cross into active exploitation matters as much as the CVSS score attached to any one bug.
The split matters for defenders. The Azure AI Foundry bug closed the moment Microsoft flipped a server-side switch. The Windows kernel bug stays open on every 26H1 machine until an administrator installs the update. Microsoft shipped that fix as a 2026-09 cumulative update, build 28000.2956, for Windows 11, version 26H1.
