Azure AI Foundry flaw with CVSS 10.0 was patched in about two hours

Microsoft disclosed CVE-2026-85889 in Azure AI Foundry (Microsoft Foundry) on 2026-09-17, a CVSS 3.1 10.0 flaw classified as CWE-306, missing authentication for a critical function. The issue was neither publicly disclosed nor exploited, and remediation completed in roughly two hours; researcher Rémy Marot is credited.

• CVSS 3.1 score 10.0, vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, CWE-306
• Temporal score 8.7: no exploitation and no public proof of concept
• Fix landed in about two hours; customers had nothing to deploy
• An earlier severe flaw, CVE-2026-32213, hit the platform in April