Critical Microsoft Azure AI Foundry Vulnerability Allows Attackers to Escalate Privileges

CVE-2026-85878 is an improper authorization flaw (CWE-285) in Microsoft's Azure Database for PostgreSQL managed service. An attacker who already holds some authorized, low-privilege access — such as an authenticated database user — can send network requests that the service fails to properly authorize, thereby elevating their privileges. The CVSS 3.1 score of 9.9 reflects network exploitability, low attack complexity, no user interaction, a scope change (impact extending beyond the vulnerable component), and high impact on confidentiality, integrity, and availability. All customers running Azure Database for PostgreSQL are potentially affected until remediated. The flaw is not currently listed in CISA's Known Exploited Vulnerabilities catalog and no public proof-of-concept is known.

Do: Check the MSRC advisory and Azure Service Health, and confirm your instances have received Microsoft's service-side fix, as managed Azure databases are typically patched by Microsoft rather than by customer upgrades. Until remediation is confirmed, enforce least-privilege database roles, audit role and admin memberships for unexpected grants, and restrict network exposure using firewall rules, Private Link/Private Endpoints, and VNet integration. Review PostgreSQL audit logs and Microsoft Defender for open-source relational databases alerts for signs of privilege escalation attempts.

CVE-2026-85885 is a command injection flaw (CWE-77) in Microsoft 365 Copilot in which special elements in user-supplied input are improperly neutralized before being passed to a command interpreter. An authorized, low-privileged user can trigger it over the network with crafted input and no user interaction or special conditions. Successful exploitation elevates the attacker's privileges, with high impact to confidentiality, integrity, and availability, and the changed scope in the CVSS vector indicates impact can extend beyond the initially compromised component. Any organization whose users have Microsoft 365 Copilot enabled is in scope, since the flaw resides in Microsoft's cloud service rather than a locally installed product. There is currently no evidence of exploitation in the wild, no public proof-of-concept, and the flaw is not listed in CISA's KEV catalog.

Do: Check the MSRC advisory for CVE-2026-85885 and confirm your tenant has received Microsoft's server-side update, since fixes for the Copilot cloud service are deployed by Microsoft rather than patched locally. In the interim, limit Copilot licenses and access to users who need them and review Microsoft 365 audit logs for unusual privileged actions originating from low-privileged accounts. If the advisory lists any client-side component version to update, apply it promptly.

CVE-2026-85889 is a missing authentication flaw (CWE-306) in Microsoft Azure AI Foundry, meaning a critical function can be reached without any credential check. An unauthenticated attacker can trigger it remotely over a network with no user interaction and no privileges required. Successful exploitation allows the attacker to elevate privileges, and the CVSS scope-change designation (S:C) indicates the impact can extend beyond the initially compromised security authority, with high confidentiality, integrity, and availability impact. Any organization using Azure AI Foundry is potentially affected, though the flaw is in a Microsoft-managed cloud platform rather than a customer-deployed package. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is currently known.

Do: Because Azure AI Foundry is a Microsoft-managed service, monitor Microsoft's security advisory and Azure Service Health for patched status and any customer-required actions rather than applying your own patch. In the meantime, review role assignments, API keys, and network access controls (firewalls, private endpoints, virtual-network restrictions) on your Foundry resources, and check Azure activity logs for unauthenticated or anomalous privilege-related operations. Rotate credentials if suspicious activity is found and watch for updates, as a CVSS 10.0 flaw may draw rapid attacker attention.