Microsoft has disclosed and already fixed a maximum-severity flaw in Azure AI Foundry, the managed platform businesses use to build and run generative AI applications and agents. Tracked as CVE-2026-85889 and rated a full 10.0 out of 10 on the CVSS scale, the bug was a missing authentication check on a backend function — meaning an attacker with no valid credentials could reach a privileged part of the service directly and escalate their access, simply by sending the right request over the network.
Because Azure AI Foundry is a cloud service Microsoft operates and patches centrally, the fix was rolled out on the back end the same day it was disclosed, 18 September. Microsoft says it found no evidence the flaw was ever exploited and no public proof-of-concept code has circulated, and credits independent researcher Rémy Marot with reporting it before that changed. No customer configuration, update, or restart is required — if you use Azure AI Foundry today, you were already protected once Microsoft shipped the fix. The disclosure landed alongside two other critical Microsoft fixes (CVSS 9.9 each) reported the same week, part of a broader pattern of scrutiny on the authentication layer of fast-moving cloud AI platforms.
What this means for your business
There's nothing to patch here — that's the point worth taking away. But if your business is building on Azure AI Foundry, or evaluating an AI platform vendor generally, this is a useful moment to ask a few questions rather than assume "the cloud handles it." Confirm you're using Microsoft's fully managed Foundry service rather than a self-hosted component of the SDK, since only the managed side gets these fixes automatically. If your team or developer has built custom agents or API integrations on top of Foundry, check that those integrations enforce their own authentication on every endpoint they expose — a missing-auth bug in your own code doesn't get fixed by Microsoft's patch. More broadly, "missing authentication for a critical function" is becoming a recurring flaw class in AI platforms racing to ship new capabilities; when choosing or renewing with any AI vendor, it's reasonable to ask how quickly they patch and whether they run independent security testing before launch, not just after a researcher finds something.