InfoSecBulletin Cybersecurity for mankind
Microsoft has fixed a serious security flaw in Azure AI Foundry that could let bad actors gain privilege escalation. The vulnerability, tracked as CVE-2026-85889, carries a CVSS score of 10.0. “Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network,” Microsoft said in a Thursday advisory.
Azure AI Foundry, known as Microsoft Foundry, is a business platform that helps create, launch, and manage generative AI apps and agents. Microsoft thanked security researcher Rémy Marot (@R_Marot) for finding and reporting the flaw. There is no proof that anyone has taken advantage of this issue.
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Also patched by Microsoft in recent days are a number of other critical flaws:
CVE-2026-85885 (CVSS score: 9.9) – A command injection vulnerability in Microsoft 365 Copilot that could allow an authorized attacker to elevate privileges over a network
CVE-2026-85878 (CVSS score: 9.9) – An improper authorization in Azure Database for PostgreSQL that could allow an authorized attacker to elevate privileges over a network
CVE-2026-87701 (CVSS score: 9.6) – An improper neutralization vulnerability in Azure Cosmos DB that could allow an authorized attacker to elevate privileges over a network
Microsoft said the problems have been fixed already, so users don’t need to do anything. Separately, Microsoft has shipped updates for two other vulnerabilities, one of which was originally disclosed last month.
CVE-2026-62721 (CVSS score: 7.8) – An insufficient granularity of access control in Windows User-Mode Power Service (UMPS) that could allow an authorized attacker to elevate privileges locally and gain SYSTEM privileges.
CVE-2026-85921 (CVSS score: 8.2) – A double free vulnerability in Windows Secure Kernel Mode that could allow an authorized attacker to elevate privileges locally and gain Virtual Trust Level 1 (VTL1) privileges.
Both flaws have been addressed as part of an out-of-band update for Windows 11, version 26H1 –
2026-09 Cumulative Update for Windows 11, version 26H1 for arm64-based Systems (KB5129194) (28000.2956)
2026-09 Cumulative Update for Windows 11, version 26H1 for x64-based Systems (KB5129194) (28000.2956)
Microsoft shared this news after fixing a record 974 flaws in its software last week. Two of these flaws, which affect Windows Advanced Local Procedure Call (ALPC) and the Windows Update Stack, are being actively used by attackers.
Reports from Proofpoint and Volexity say that the ALPC vulnerability has been combined with two Google Chrome flaws. This has created an exploit kit called BlueMoon, which many spying groups use to send harmful software.
