Azure AI Foundry EUVD-2026-28454

Exploitation targets Azure AI Foundry agents that have been PUBLISHED to Microsoft 365 - the affected surface is specifically the M365-published-agent integration, so an environment with no agents published to M365 is not in scope. The CVSS vector (PR:N/UI:N/AC:L, AV:N) indicates no authentication, no user interaction, and low complexity against a network-reachable target, so per the available data there is no special configuration beyond having published such an agent. Limiting factors: the attacker must be able to reach the published agent endpoint over the network; because Azure AI Foundry is a Microsoft-operated service, the fix is applied vendor-side rather than by customers, which constrains the realistic exploitation window. The precise access-control defect and its trigger are not described in the available sources.

Signals conflict sharply here. The CVSS 3.1 base score is a maximal 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), describing a remotely reachable, unauthenticated, low-complexity access-control flaw with a scope change and total confidentiality, integrity and availability impact. Every other exploitation signal, however, points downward: EPSS is 0.04% (13th percentile), CISA KEV does not list it, no PoC or exploit reference is provided, and the vuln.today Decision label is 'monitor' rather than act_now/emergency. CISA SSVC further reports Exploitation: none and - notably - Technical Impact: 'partial', which directly contradicts the CVSS C:H/I:H/A:H 'total' rating; this discrepancy should be verified with Microsoft, as it may indicate the real-world impact is narrower than the 10.0 implies. SSVC Automatable: yes means that IF a technique emerges it could be scaled, so this warrants tracking even though nothing indicates current exploitation. On balance this reads as a genuinely severe-by-design access-control defect in a Microsoft-operated cloud service that is not presently an active-exploitation emergency; because Azure AI Foundry is a hosted service, the vendor-side fix is likely already applied, which also tempers urgency. Treat as high-severity-but-low-current-exploitation and follow Microsoft's guidance.

An unauthenticated attacker on the network reaches an Azure AI Foundry agent that has been published to Microsoft 365 and abuses an improper access-control check to gain privileges they should not hold, potentially acting across the scope-changed boundary into M365 resources. No public exploit or PoC is identified, and the exact trigger is not described in the available sources. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates the attack is network-reachable, low-complexity, and needs no authentication or user interaction.