EUVD-2026-82593
GHSA-4q27-2gv2-3vm4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Azure AI Foundry endpoint
-
DeliveryInvoke unauthenticated critical function
-
ExploitBypass missing authentication check
-
ExecutionElevate privileges over network
-
ImpactGain full control of service context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker needs network reachability to an affected Azure AI Foundry endpoint and invokes a specific critical function that omits an authentication check (CWE-306); per the CVSS vector no privileges (PR:N) and no user interaction (UI:N) are required. Limiting factors: because Azure AI Foundry is a Microsoft-operated cloud service, the vulnerable surface and any fix are controlled server-side by Microsoft, so the practical window and reachability depend on Microsoft's own deployment and tenant exposure rather than customer configuration; the description names no specific feature, protocol, or configuration mode, so the exact critical function that lacks authentication is not disclosed. |
| Impact | Signals conflict sharply. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, base 9.8 CRITICAL) and CWE-306 (missing authentication for a critical function) describe an unauthenticated, network-reachable privilege-elevation flaw with total technical impact - matching CISA SSVC's 'Technical Impact: total' and 'Automatable: yes'. However, SSVC 'Exploitation: none', EPSS of only 0.49% (41st percentile), no CISA KEV listing, and no public POC all indicate that despite the maximal theoretical severity, there is currently no evidence of exploitation. The description is a single boilerplate MSRC sentence with no technical detail, no affected version data (EUVD lists only 'Azure AI Foundry -'), and no independent corroboration - the only substantive reference is Microsoft's own MSRC page (the NVD/EUVD links are cross-references). Because Azure AI Foundry is a Microsoft-operated cloud service, remediation is almost certainly server-side and already deployed by Microsoft rather than a customer patching action, which materially reduces real-world exposure regardless of the 9.8 score. Net: genuinely high theoretical severity for a critical-function auth gap, but low current operational urgency given no exploitation signal and likely centralized cloud remediation. Impact metrics (C:H/I:H/A:H) are inherited from Microsoft and cannot be independently verified from the vague description. |
| Exploit ScenarioDerived | An attacker with only network reachability to an affected Azure AI Foundry endpoint invokes a critical function that fails to enforce authentication, using the resulting access to elevate privileges within the service. No public exploit code has been identified and CISA reports no known exploitation; SSVC flags the flaw as automatable, so if a working technique emerged it could be scripted at scale. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 25, 2026
Unauthenticated remote attackers can reach a critical function inside Microsoft Azure AI Foundry that performs a privileged operation without any authentication check, giving high confidentiality, integrity and availability impact across the affected service (CVSS 3.1 AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, CWE-306). The weakness lives in a Microsoft-operated cloud service rather than a customer-installable product, so both the exposed surface and the fix are controlled server-side by Microsoft and the specific impacted feature is not publicly disclosed. Exploitation signals currently conflict: no public exploit code has been identified and CISA's SSVC rates exploitation as 'none' (automatable: yes, technical impact: total) with a low EPSS of 0.49% (41st percentile), yet the unauthenticated, no-user-interaction path makes the bug trivially automatable once technical details circulate.
Earlier versions of this analysis (1)
Unauthenticated remote privilege escalation in Microsoft's Azure AI Foundry cloud service: a critical function is exposed without any authentication check (CWE-306), so an attacker on the network can reach it with no credentials, no user interaction, and low attack complexity, and pivot beyond their own authorization boundary into other tenant or service resources. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) rates 10.0, reflecting full confidentiality, integrity, and availability impact with a scope change across a multi-tenant cloud boundary. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV), but the absence of any authentication prerequisite makes the pre-fix exposure window unusually dangerous; because Azure AI Foundry is Microsoft-operated, the flaw is remediated server-side and there is no on-premises deployment for an attacker to target after remediation.
RemediationAI
No vendor-released patch version is specified in the available data; because Azure AI Foundry is a Microsoft-operated service, remediation is delivered server-side and customers should monitor the Microsoft MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85889 for the fixed deployment status and any tenant-side actions Microsoft prescribes. Until remediation is confirmed, network reachability is effectively the only control point - authentication hardening cannot help because the affected function is unauthenticated by design and every caller (PR:N) is anonymous to it - so the practical compensating controls are network-scoped. Restrict access to Azure AI Foundry endpoints using Azure Private Link/private endpoints, IP allow-listing, or service-tag-based network security groups, accepting the trade-off that this breaks public or partner access to workspaces and requires client-side network changes such as VPN or ExpressRoute. Disable or undeploy unused Azure AI Foundry hubs, projects and model or agent endpoints to shrink the reachable attack surface, at the cost of losing those capabilities for legitimate users. Enable Azure Monitor diagnostic logs, Activity Log alerting and Microsoft Defender for Cloud / AI threat protection to detect anomalous unauthenticated invocations of AI Foundry APIs, noting that detection does not prevent the initial privilege escalation and may generate noisy alerts. Finally, reduce blast radius by isolating sensitive data and credentials from Azure AI Foundry workspaces through tightly scoped managed identities, Key Vault access policies and least-privilege RBAC - this limits what a successful escalation can reach but does not eliminate the underlying flaw.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-306, Missing Authentication for Critical Function: a server-side routine in Azure AI Foundry that performs a sensitive, privilege-bearing operation is reachable over the network without verifying the caller's identity or authorization. Azure AI Foundry is Microsoft's managed platform for building, deploying and governing AI models, hubs, projects and agents, which means the vulnerable code, its exposure and any fix sit entirely inside Microsoft's tenancy - customers cannot patch or version-pin it, and the CPE cpe:2.3:a:microsoft:azure_ai_foundry:-:*:*:*:*:*:*:* carries a '-' version field precisely because the service is continuously updated rather than released as a discrete artifact. Unlike memory-corruption or injection bugs, CWE-306 exposes functionality directly with no authentication gate, so any network-reachable caller (PR:N, UI:N, no privileges required) can invoke it with ordinary tooling, which is why SSVC flags the issue as automatable with total technical impact. The Microsoft MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85889) and ENISA EUVD entry EUVD-2026-82593 are the authoritative tracking sources, but neither the supplied advisory data nor the CVE description names the specific feature, endpoint or protocol that omits authentication.
Know when Azure gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-306 missing auth over a network with no privileges or interaction gives AV:N/AC:L/PR:N/UI:N; privilege elevation with total technical impact supports C:H/I:H/A:H, though impacts are Microsoft-asserted.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
Executive ViewAI
Microsoft Azure AI Foundry is affected by a critical unauthenticated access-control weakness that could allow remote actors to invoke privileged operations, risking exposure or alteration of AI workloads and disruption of affected service capabilities for organizations using the platform. Because the service is Microsoft-operated and no vendor-released patch has been identified, customers cannot remediate it directly and remain dependent on Microsoft-side mitigations while treating Azure AI Foundry as elevated risk. Leadership should prioritize confirming exposure, restricting access where possible, and monitoring for Microsoft guidance or signs of abuse because the flaw requires no credentials or user interaction once technical details circulate.
No vendor-released patch identified. Interim mitigations: restrict network access to Microsoft Azure AI Foundry endpoints to trusted networks or private endpoints where supported; disable or isolate unused Azure AI Foundry features and public-facing endpoints; enforce least privilege and conditional access for administrative identities; enable and monitor diagnostic logs and alerts for privileged operations; open a Microsoft support case and monitor vendor advisories for server-side mitigations; prepare incident-response procedures for cloud-service compromise.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation in Microsoft's Azure Billing service allows unauthenticated, remote attackers to reach full comprom
Path traversal in pnpm's tarball extraction on Windows allows attackers to write files outside the intended package dire
Default password in Himmelblau Azure Entra ID suite 3.0.0-3.0.x. CVSS 10.0.
Privilege escalation in Azure Database for PostgreSQL allows an authenticated attacker with low privileges to elevate pr
Path traversal in Microsoft's Azure Logic Apps (CWE-22) lets a remote, unauthenticated attacker escape an intended restr
Default credentials in Cisco ISE cloud deployments on AWS/Azure/OCI. CVSS 9.9.
Deserialization of untrusted data in Azure SDK allows unauthorized code execution over a network. EPSS 0.32%.
Elevation of privilege vulnerability in Azure Front Door allows attackers to gain elevated access. Microsoft Azure cloud
Azure Front Door has an improper access control vulnerability (CVSS 9.8) allowing unauthorized attackers to elevate priv
Azure AD auth bypass in Devolutions Server 2025.3.15.0 and earlier.
Fleet device management software has a signature verification bypass that allows attackers to install malicious firmware
Privilege elevation in Microsoft Azure Cosmos DB allows an attacker who already holds valid low-level authorization to a
Exploit-DB