CVE-2026-85889: the Azure AI Foundry 10.0 was fixed before anyone could use it

What was disclosed

Microsoft published CVE-2026-85889 on 2026-09-17 for Azure AI Foundry, also documented as Microsoft Foundry. The CVSS 3.1 base score is 10.0 on the vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, which reads as remote, low complexity, no privileges, no user interaction, a scope change, and high impact on confidentiality, integrity and availability. The classification is CWE-306, missing authentication for a critical function.
The researcher credited is Rémy Marot. Microsoft's record states that the flaw was neither publicly disclosed nor exploited, and that no public proof of concept exists. The temporal score reflects that: 8.7, which the coverage attributes to an absence of confirmed exploitation maturity combined with a confirmed, already-shipped fix.

What missing authentication on an AI platform control plane means

A hosted platform has no endpoint to patch, so Microsoft fixed the service and recorded the flaw afterwards. Coverage describes remediation completing in about two hours, which is the advantage of a control plane you operate: the fix lands once, for everyone, without a maintenance window.
The interesting part is what the missing check protected. Azure AI Foundry is where enterprise teams deploy models, build agents and orchestrate workflows. Those assets include model endpoints, orchestration logic, connected data sources and the credentials that let an agent act on a business system. An unauthenticated path into the control plane is a path to all of it, and the impact is different from a stolen inference endpoint because the attacker does not just read outputs, they can change how the agent behaves.
This is not the first severe flaw in this platform. Coverage notes an earlier identifier, CVE-2026-32213, in April, which is the more useful fact than the 10.0 itself. A control plane that accumulates severe findings is telling you something about the pace at which its authentication model is being extended.

What customers can still do

Cloud service patching is invisible, which cuts both ways: there is nothing to deploy, and there is also nothing in your change log to prompt a review of what the asset is worth. The productive response is an inventory question rather than a patching question.
Map which agents exist, what each one can reach, and what credentials it holds. An agent that can read a ticketing system and send mail on behalf of a shared mailbox is a different risk from one that can only summarise documents, and the control plane flaw affected both equally because it sat above them.
Then apply the ordinary controls to agent identities: a dedicated identity per agent rather than a shared service account, short-lived credentials, and a review of what each agent can write as well as read. Log the control plane operations that change an agent definition, because that is the boundary a platform flaw would cross.

Where the limits are

Microsoft's record states no exploitation and no public proof of concept, so this is a near miss rather than an incident, and describing it otherwise would be inaccurate. The 10.0 score describes the flaw in isolation. The operational lesson is about what a hosted AI control plane concentrates, not about a specific compromise.

References

1. FreeBuf: a CVSS 10.0 AI platform flaw patched in two hours, and the authentication model questions that remain
2. CSDN: the cost of a perfect score, Azure AI Foundry's missing authentication
3. Microsoft weekly review covering CVE-2026-85889 and the CVSS vector
4. Microsoft Learn: deploying models with managed compute in Microsoft Foundry