Missing authentication for critical function in Azure AI Foundry

CVE-2026-85889 is a missing-authentication flaw (CWE-306) in Azure AI Foundry, Microsoft's managed cloud platform for building, training, and deploying AI models. The vulnerability allowed an unauthenticated attacker to reach privileged internal API endpoints over the network — endpoints that should have required OAuth2 bearer tokens or service-account credentials — and escalate privileges within the service. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H scores a perfect 10.0 because the theoretical impact spans confidentiality, integrity, and availability with scope change and zero prerequisites.

The vendor severity of CRITICAL (10.0) is technically accurate for the vulnerability itself but wildly misleading for enterprise patch management. Azure AI Foundry is a fully managed cloud service — Microsoft owns the infrastructure, the control plane, and the patch cycle. Microsoft has confirmed the fix was applied server-side and that *no customer action is required*. There is no MSI to push, no KB to install, no container image to pull. The exposure window opened and closed entirely within Microsoft's operational domain. For a defender managing 10,000 hosts, this CVE generates zero work orders. The only residual action is a retrospective log audit to verify no unauthorized access occurred during the brief exposure window.

Why this verdict

• No customer-deployable patch exists. Azure AI Foundry is a managed PaaS — Microsoft applies fixes server-side. There is literally nothing to put in your WSUS queue, SCCM deployment, or Ansible playbook.
• Exposure window already closed. Microsoft patched this within hours of disclosure. No public PoC emerged. The attack surface existed for <24 hours in Microsoft's infrastructure, not yours.
• Role multiplier: Azure AI Foundry as an AI/ML platform. In its high-value role, Foundry projects may hold sensitive training data, model IP, and connected Key Vault secrets. A successful exploit during the window *could* have enabled cross-tenant data exfiltration (blast radius: tenant → potentially multi-tenant). However, because this is cloud-managed and already patched, the role multiplier applies only to retrospective audit urgency, not forward-looking patch priority. The high-value role does not override the fundamental reality that the defender has no patch to apply.
• No KEV, no exploitation evidence, no PoC. All three intelligence signals are absent, confirming this was caught and fixed before weaponization.

Why not higher?

A MEDIUM or higher rating would imply defenders need to take active remediation steps. They don't. Microsoft has already closed this vulnerability server-side. There is no patch to deploy, no configuration to change, and no compensating control to implement. Elevating this would waste patch-management cycles on a non-actionable item.

Why not lower?

An IGNORE rating would skip the retrospective audit step entirely. Given the CVSS 10.0 theoretical impact and the brief window where unauthenticated access to privileged AI platform functions was possible, defenders running Azure AI Foundry projects with sensitive data should verify no unauthorized access occurred. The audit obligation — not a patch obligation — keeps this at LOW rather than IGNORE.

1. Audit Azure Activity Logs for the exposure window (2026-09-16 to 2026-09-18) — Review Azure Monitor and Azure Activity Log for any unusual management-plane API calls to Azure AI Foundry resources during the pre-patch window. Look for unauthenticated or anomalous access patterns. No SLA applies (LOW verdict), but complete within 30 days as backlog hygiene.
2. Verify Private Link / VNet integration on Foundry projects — If your Azure AI Foundry projects use Private Link or VNet-injected networking, confirm these controls were active during the exposure window — they would have prevented internet-originating exploitation regardless of the auth bypass.
3. Rotate any secrets stored in connected Key Vaults — As a precaution, rotate API keys, connection strings, and service principal credentials stored in Key Vaults connected to Azure AI Foundry projects. This is a low-cost hedge against undetected access during the window.

Run this script from any workstation with the Azure CLI (az) installed and authenticated to your tenant. It checks Azure Activity Logs for suspicious unauthenticated access to AI Foundry resources during the exposure window. Requires Reader role on the relevant subscription. Example: bash check_cve_2026_85889.sh --subscription <sub-id>

#!/usr/bin/env bash
# check_cve_2026_85889.sh — Audit Azure AI Foundry access during CVE-2026-85889 exposure window
# Usage: bash check_cve_2026_85889.sh --subscription <subscription-id>
# Requires: Azure CLI (az) authenticated with Reader role
# Output: VULNERABLE (suspicious activity found) / PATCHED (no issues) / UNKNOWN (check failed)

set -euo pipefail

SUB_ID=""
while [[ $# -gt 0 ]]; do
  case "$1" in
    --subscription) SUB_ID="$2"; shift 2 ;;
    *) echo "Usage: $0 --subscription <subscription-id>"; exit 3 ;;
  esac
done

if [[ -z "$SUB_ID" ]]; then
  echo "ERROR: --subscription is required"
  echo "UNKNOWN"
  exit 3
fi

# Check Azure CLI is available and authenticated
if ! command -v az &>/dev/null; then
  echo "ERROR: Azure CLI (az) not found"
  echo "UNKNOWN"
  exit 3
fi

if ! az account show &>/dev/null 2>&1; then
  echo "ERROR: Not authenticated to Azure CLI. Run 'az login' first."
  echo "UNKNOWN"
  exit 3
fi

echo "Checking Azure Activity Log for subscription $SUB_ID..."
echo "Window: 2026-09-16T00:00:00Z to 2026-09-18T23:59:59Z"
echo ""

# Query activity log for AI Foundry / AI Studio resource operations during the window
SUSPICIOUS=$(az monitor activity-log list \
  --subscription "$SUB_ID" \
  --start-time 2026-09-16T00:00:00Z \
  --end-time 2026-09-18T23:59:59Z \
  --query "[?contains(resourceType || '', 'Microsoft.MachineLearningServices') || contains(resourceType || '', 'Microsoft.AIFoundry')].{caller:caller, time:eventTimestamp, op:operationName.value, status:status.value}" \
  --output json 2>/dev/null || echo "QUERY_FAILED")

if [[ "$SUSPICIOUS" == "QUERY_FAILED" ]]; then
  echo "ERROR: Failed to query activity log. Check permissions."
  echo "UNKNOWN"
  exit 3
fi

COUNT=$(echo "$SUSPICIOUS" | python3 -c "import sys,json; print(len(json.load(sys.stdin)))" 2>/dev/null || echo "0")

if [[ "$COUNT" -gt 0 ]]; then
  echo "Found $COUNT management-plane operations during exposure window."
  echo "Review these for unauthorized access:"
  echo "$SUSPICIOUS" | python3 -m json.tool 2>/dev/null || echo "$SUSPICIOUS"
  echo ""
  echo "VULNERABLE"
  exit 1
else
  echo "No Azure AI Foundry management-plane operations found during exposure window."
  echo "PATCHED"
  exit 0
fi

Sources

1. MSRC Advisory — CVE-2026-85889
2. GuardianMSSP — Microsoft Patches CVSS 10.0 Azure AI Foundry Flaw
3. TheWindowsUpdate — CVE-2026-85889 Advisory
4. Strix.ai — CVE-2026-85889 Analysis
5. OffSeq Threat Radar — CVE-2026-85889
6. Microsoft Foundry Architecture — Microsoft Learn
7. CISA KEV Catalog