CVE-2026-85889 is a missing authentication for critical function flaw in Azure AI Foundry (CVSS 10.0, critical). It allows an unauthorized attacker to elevate privileges over a network. Check the Microsoft guidance for any action on your side. The sections below cover affected versions, how to check your exposure and what to do first.
What's affected
The record names Azure AI Foundry and gives a short description: missing authentication for a critical function allows an unauthorized attacker to elevate privileges over a network. The weakness is CWE-306. The record gives no affected version, since it is a cloud service.
The Microsoft page was not readable from my tooling, so I cannot say whether customers need to act. Cloud service records of this kind are often fixed by the provider with no customer step, but that has to be confirmed in the Microsoft guide. The record is not in the CISA KEV catalog.
How to check if you're exposed
Open the Microsoft Security Response Center entry for CVE-2026-85889 and read the Customer Action section. Then review Azure AI Foundry resources in your subscriptions and the Azure activity log for unexpected role assignments or changes.
az role assignment list --all --output table
What to do now
- Read the MSRC update guide entry and note whether it requires customer action.
- Review role assignments on your Azure AI Foundry resources and remove any you cannot explain.
- Check the activity log for privilege changes in the days around the publication date.
- Follow least privilege for service principals and managed identities connected to Foundry projects.
- Subscribe to MSRC notices for the service.
Why it matters
Missing authentication means a function that should check who is calling does not. A score of 10.0 reflects a network path with no login, low complexity and a changed scope, which is the worst combination on the scale.
With managed services, the provider usually owns the fix, but you still own the identity setup around it. Reviewing who holds which role is worth doing after any entry like this one.
Quick check
Do I need to patch anything?
The record gives no version, and I could not read the Microsoft page. Check the MSRC guide for customer action.
Sources
Last reviewed: 19 October 2026.
