InfoSecBulletin Cybersecurity for mankind
Microsoft has fixed a serious security flaw in Azure AI Foundry that could let bad actors gain privilege escalation. The vulnerability, tracked as CVE-2026-85889, carries a CVSS score of 10.0. “Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network,” Microsoft said in a Thursday advisory.
Azure AI Foundry, known as Microsoft Foundry, is a business platform that helps create, launch, and manage generative AI apps and agents. Microsoft thanked security researcher Rémy Marot (@R_Marot) for finding and reporting the flaw. There is no proof that anyone has taken advantage of this issue.
OpenAI AI Pipeline Discovers 948 Linux Kernel Privilege Escalation Flaws in 30 Hours
Bangladeshi Researcher Rasel Earns First Apple CVE Recognition for Model I/O Flaw
WinRAR, WordPress RCE flaw & Zyxel GS1900 Zero-Day exploited in the wild
Daily Cyber security update for 04.11. 2026
Daily Cyber security update for 03.11. 2026
Using ARTEX AI, Hacker to attack 200 Organizations Across 14 Countries
Amadeus cyber incident impacted “Cathay Pacific, Qantas, Japan, Malaysia, Korean & Asiana” Airlines
Multiple European supermarket fridges got hacked: Temperatures reached high as 55°C
Apple Warns 99 Countries iPhone Users of Mercenary Spyware Attacks
Daily Cyber security update for 31.10. 2026
Also patched by Microsoft in recent days are a number of other critical flaws:
CVE-2026-85885 (CVSS score: 9.9) – A command injection vulnerability in Microsoft 365 Copilot that could allow an authorized attacker to elevate privileges over a network
CVE-2026-85878 (CVSS score: 9.9) – An improper authorization in Azure Database for PostgreSQL that could allow an authorized attacker to elevate privileges over a network
CVE-2026-87701 (CVSS score: 9.6) – An improper neutralization vulnerability in Azure Cosmos DB that could allow an authorized attacker to elevate privileges over a network
Microsoft said the problems have been fixed already, so users don’t need to do anything. Separately, Microsoft has shipped updates for two other vulnerabilities, one of which was originally disclosed last month.
CVE-2026-62721 (CVSS score: 7.8) – An insufficient granularity of access control in Windows User-Mode Power Service (UMPS) that could allow an authorized attacker to elevate privileges locally and gain SYSTEM privileges.
CVE-2026-85921 (CVSS score: 8.2) – A double free vulnerability in Windows Secure Kernel Mode that could allow an authorized attacker to elevate privileges locally and gain Virtual Trust Level 1 (VTL1) privileges.
Both flaws have been addressed as part of an out-of-band update for Windows 11, version 26H1 –
2026-09 Cumulative Update for Windows 11, version 26H1 for arm64-based Systems (KB5129194) (28000.2956)
2026-09 Cumulative Update for Windows 11, version 26H1 for x64-based Systems (KB5129194) (28000.2956)
Microsoft shared this news after fixing a record 974 flaws in its software last week. Two of these flaws, which affect Windows Advanced Local Procedure Call (ALPC) and the Windows Update Stack, are being actively used by attackers.
Reports from Proofpoint and Volexity say that the ALPC vulnerability has been combined with two Google Chrome flaws. This has created an exploit kit called BlueMoon, which many spying groups use to send harmful software.
