CVE-2026-35435 is an improper access control flaw in Azure AI Foundry M365 published agents, scored 8.6 (High) in the CVE record. An unauthorized attacker can elevate privileges over a network. Microsoft handles the fix for the service, so check the MSRC guide for its status.
What's affected
- Product: Microsoft Azure AI Foundry, M365 published agents
- Affected versions: not applicable in the usual sense, since this is a cloud service
- Fixed version: none listed in the record. The Microsoft advisory is the authority on the remediation state
The record gives no further technical detail, and the Microsoft page did not render without JavaScript, so the customer action is not confirmed here. Read the page itself before you decide. The CVE is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
For a hosted service there is no package to inspect. Start with the Microsoft Security Response Center entry for this CVE and read whether any customer action is required.
If you publish agents from Azure AI Foundry to Microsoft 365, list them and note who can reach each one. Check the access settings of every published agent against what you intend.
What to do now
- Open the MSRC entry for CVE-2026-35435 and read the remediation guidance in full.
- List the Foundry agents you have published to Microsoft 365.
- Review who has access to each published agent and remove access that is no longer needed.
- Check the audit and activity logs for the affected agents for access you cannot explain.
- Add the entry to your cloud service risk register so the status is revisited.
Why it matters
The record files this under CWE-284, improper access control. The CVSS vector shows a network attack with no privileges and no user interaction, and a changed scope. That means a successful attacker could affect resources beyond the component itself.
With cloud services the vendor often fixes the problem on its side, and the customer's job is to confirm that and to keep access tight. Agent products connect to documents and tools, so who can reach an agent matters as much as the agent code.
Quick check
Do I need to install a patch?
The record lists no fixed version. For a hosted service the vendor usually applies the fix. Confirm what Microsoft says in the MSRC entry.
Is this exploited in the wild?
The record does not say so, and the CVE is not in the CISA catalog.
Sources
Last reviewed: 19 October 2026.
