Microsoft Patches CVSS 10.0 Azure AI Foundry Flaw Enabling Unauthorized Privilege Escalation

Microsoft has released fixes for a maximum-severity security flaw in Azure AI Foundry that could be exploited to achieve privilege escalation. No customer action is required. The vulnerability, tracked as CVE-2026-85889 , carries a CVSS score of 10.0. "Missing authentication for critical function...

EUVD-2026-82594

Server-side request forgery ssrf in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network...

EUVD-2026-82593

Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-85889

Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-85917

Server-side request forgery ssrf in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-85917

A server-side request forgery (SSRF) vulnerability in Azure AI Foundry allows an unauthorized, network-based attacker to elevate privileges. The CVSS 3.1 score is 7.5 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating no privileges required, low complexity, and a high confide...

CVE-2026-85889

Azure AI Foundry is affected by a missing authentication vulnerability in a critical function, allowing an unauthenticated attacker to elevate privileges over a network. The flaw is rated CRITICAL (CVSS 3.1: 10.0) with a vector of network-based, low complexity, no privileges required, no user int...

Azure AI Foundry Elevation of Privilege Vulnerability

Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network...

Azure AI Foundry Elevation of Privilege Vulnerability

Server-side request forgery ssrf in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-85917: Server-Side Request Forgery (SSRF)

Server-side request forgery ssrf in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-85889: Missing Authentication for Critical Function

Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network...

PT-2026-95176

Name of the Vulnerable Software and Affected Versions Azure AI Foundry affected versions not specified Description Server-side request forgery SSRF allows an unauthorized attacker to elevate privileges over a network. SSRF is a flaw where an attacker can induce the server-side application to make...

PT-2026-95175

Name of the Vulnerable Software and Affected Versions Azure AI Foundry affected versions not specified Description Azure AI Foundry contains a flaw in its core authentication module where a critical function lacks proper authentication. This allows an unauthenticated attacker to escalate privileg...

Azure AI Language Authoring Service Privilege Escalation

The vulnerability of Azure AI Language Authoring lies in the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker to increase their privileges remotely...

Azure AI Language Elevation of Privilege Vulnerability

Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network...

EUVD-2026-70793

Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-70352

Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-70352 Azure AI Language Elevation of Privilege Vulnerability

...

CVE-2026-70352 Azure AI Language Elevation of Privilege Vulnerability

...

CVE-2026-70352

Azure AI Language is affected by a missing authentication vulnerability in a critical function, allowing an unauthorized attacker to elevate privileges over a network . The vulnerability is rated CVSS 10.0 (CRITICAL) with low complexity, no privileges required, no user interaction, and changed sc...