On September 17, 2026, Microsoft shipped an out-of-band fix for a vulnerability in Azure AI Foundry, the enterprise platform thousands of companies use to build, deploy and govern generative AI applications and agents. The severity is CVSS 10.0, the maximum. The description is one sentence, and it is worth reading slowly: missing authentication for a critical function.
Translated out of vendor language: an unauthenticated attacker on the network could reach a critical function of the platform with no login at all, and use it to elevate privileges. No credential. No phishing step. No user interaction. Just a reachable endpoint and a missing check.
Microsoft says there is no evidence that the flaw, tracked as CVE-2026-85889, has been exploited in the wild. The company also says it has already been fully mitigated server-side and requires no customer action. Both statements are almost certainly true. Neither one is the interesting part.
What Microsoft actually disclosed
CVE-2026-85889 did not arrive alone. In the same window, Microsoft patched a cluster of critical issues across its cloud estate:
- CVE-2026-85885 (CVSS 9.9): command injection in Microsoft 365 Copilot that could allow an attacker to elevate privileges over the network.
- CVE-2026-85878 (CVSS 9.9): improper authorization in Azure Database for PostgreSQL with the same escalation outcome.
- CVE-2026-87701 (CVSS 9.6): improper neutralization in Azure Cosmos DB, again enabling privilege escalation.
- CVE-2026-69843 and CVE-2026-62874: maximum-severity issues in Microsoft Fabric and Azure Billing, both rated 10.0 by independent trackers.
The same week, Microsoft closed a record 974 vulnerabilities across its portfolio in its September Patch Tuesday, two of which are already under active exploitation. Researchers have chained one of them, a Windows ALPC flaw, into an exploit kit called BlueMoon that multiple espionage-aligned groups have used alongside two Chrome zero-days.
Read that list as a shape rather than a set of unrelated incidents. The 10.0s and the 9.9s are not scattered across desktop software. They cluster in clouds, in data platforms, and in AI services. That is where the enterprise attack surface moved, so that is where the critical findings follow.
"No customer action required" is not "no customer work"
The phrase means the vendor has fixed the server you rent. It says nothing about the consequences on your side, and this is where most teams stop reading.
An unauthenticated privilege escalation in an AI platform is a control-plane problem. Azure AI Foundry is not a chatbot in a tab. It is the place where models are deployed, where prompts and evaluation data live, where connected data sources are wired in, where agent identities and tool permissions are defined. Depending on how your tenant is configured, reaching that layer can mean reaching your storage accounts, your Key Vault, your Azure OpenAI deployments, or the service principals that hold the keys to the rest of your estate.
"Already mitigated" answers the question the vendor is responsible for. It does not answer the question you are responsible for: what would a brief window of unauthenticated access to that layer have exposed in your environment?
Your AI platform is a control plane. Treat it like one.
For a decade we have treated cloud IAM, CI/CD and Kubernetes control planes as Tier-0 systems: privileged-access review, change logging, network restrictions, break-glass procedures. AI platforms have grown into exactly that category while mostly being governed like a project workspace.
That is the gap this disclosure should close. Three practical consequences follow.
- Inventory first. You cannot reason about blast radius if you do not know which tenants, subscriptions and AI services you run. Most organisations we see have AI services standing up faster than their asset register updates.
- Draw the identity map. For each AI platform, list every managed identity, service principal and connection it can assume, and every data store it can read. The blast radius of an AI control-plane flaw is that map, not the platform itself.
- Put AI control planes in the privileged tier. Named administrators, MFA and conditional access, session logging, restricted network exposure, and alerting on administrative changes, exactly as you would for a domain controller or a cloud root account.
Why a 10.0 lands differently on an AI platform
A missing authentication check is a classic, almost mundane class of bug. It has been in the OWASP dictionary for years. What has changed is the value of the thing behind the check.
Three years ago, an unauthenticated flaw in a data analytics service was a serious problem inside one department. Now the same class of bug sits in front of the system that decides which tools your agents may call, what data they may read, and which credentials they may borrow. The severity score did not change. The asset did.
There is a second effect worth naming. AI workloads concentrate sensitive material by design: prompts containing customer data, evaluation sets assembled from internal documents, retrieval indexes built over everything the business knows. Compromise of the control plane is not a side door into one application. It is a map and a key to the material that feeds all of them.
What we are telling clients this week
- Confirm your exposure and your version posture. Cloud-delivered services are patched by the vendor, but self-managed components in the same architecture, including Azure Database for PostgreSQL and Cosmos DB configurations, deserve a deliberate review.
- Re-check the identity and access design around your AI workloads. Least privilege between the AI layer and the data layer is the single highest-value control you own, and it survives platform bugs that patching cycles cannot.
- Keep secrets out of agent runtimes. Long-lived keys in an agent environment turn a platform flaw into an estate-wide incident.
- Log and alert on control-plane changes. If nobody notices a new service principal or a modified deployment, the fix timeline is being measured by someone else.
- Give every AI service a named owner. Untracked AI services are the ones discovered during an incident. Find them now.
The bigger picture
Microsoft did the right thing here: the fix was fast, the advisory was clear, and the disclosure was responsible. The uncomfortable part is the pattern, not the incident. AI platforms are now production infrastructure for finance, healthcare, logistics and government workloads in this region and beyond, and they are accumulating maximum-severity findings the way cloud infrastructure did in its early years.
The teams that come out of this decade in good shape are not the ones that patch fastest. They are the ones that assume the platform will be breached eventually and design so that it is survivable: tight identity boundaries, no ambient credentials, clear ownership, and a control plane that someone is actually watching.
If you are not sure what an unauthenticated attacker could have reached through your AI platform layer, that is a conversation worth having this week.
Sources
- Microsoft Security Response Center: CVE-2026-85889, CVE-2026-85885, CVE-2026-85878, CVE-2026-87701, September 2026 advisories
- The Hacker News: Microsoft Patches CVSS 10.0 Azure AI Foundry Flaw Enabling Unauthorized Privilege Escalation, September 18, 2026
- CVE Brief archive, September 18, 2026
- Microsoft: September 2026 Patch Tuesday servicing notes