InfoSecBulletin Cybersecurity for mankind
Microsoft has fixed a serious security flaw in Azure AI Foundry that could let bad actors gain privilege escalation. The vulnerability, tracked as CVE-2026-85889, carries a CVSS score of 10.0. “Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network,” Microsoft said in a Thursday advisory.
Azure AI Foundry, known as Microsoft Foundry, is a business platform that helps create, launch, and manage generative AI apps and agents. Microsoft thanked security researcher Rémy Marot (@R_Marot) for finding and reporting the flaw. There is no proof that anyone has taken advantage of this issue.
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Also patched by Microsoft in recent days are a number of other critical flaws:
CVE-2026-85885 (CVSS score: 9.9) – A command injection vulnerability in Microsoft 365 Copilot that could allow an authorized attacker to elevate privileges over a network
CVE-2026-85878 (CVSS score: 9.9) – An improper authorization in Azure Database for PostgreSQL that could allow an authorized attacker to elevate privileges over a network
CVE-2026-87701 (CVSS score: 9.6) – An improper neutralization vulnerability in Azure Cosmos DB that could allow an authorized attacker to elevate privileges over a network
Microsoft said the problems have been fixed already, so users don’t need to do anything. Separately, Microsoft has shipped updates for two other vulnerabilities, one of which was originally disclosed last month.
CVE-2026-62721 (CVSS score: 7.8) – An insufficient granularity of access control in Windows User-Mode Power Service (UMPS) that could allow an authorized attacker to elevate privileges locally and gain SYSTEM privileges.
CVE-2026-85921 (CVSS score: 8.2) – A double free vulnerability in Windows Secure Kernel Mode that could allow an authorized attacker to elevate privileges locally and gain Virtual Trust Level 1 (VTL1) privileges.
Both flaws have been addressed as part of an out-of-band update for Windows 11, version 26H1 –
2026-09 Cumulative Update for Windows 11, version 26H1 for arm64-based Systems (KB5129194) (28000.2956)
2026-09 Cumulative Update for Windows 11, version 26H1 for x64-based Systems (KB5129194) (28000.2956)
Microsoft shared this news after fixing a record 974 flaws in its software last week. Two of these flaws, which affect Windows Advanced Local Procedure Call (ALPC) and the Windows Update Stack, are being actively used by attackers.
Reports from Proofpoint and Volexity say that the ALPC vulnerability has been combined with two Google Chrome flaws. This has created an exploit kit called BlueMoon, which many spying groups use to send harmful software.
