Microsoft Patches 18 Azure and Copilot Vulnerabilities, Headlined by CVSS 10.0 Azure AI Foundry Flaw

Insufficient granularity of access control in User-Mode Power Service (UMPS) allows an authorized attacker to elevate privileges locally.

CVE-2026-85878 is an improper authorization flaw (CWE-285) in Microsoft's Azure Database for PostgreSQL managed service. An attacker who already holds some authorized, low-privilege access — such as an authenticated database user — can send network requests that the service fails to properly authorize, thereby elevating their privileges. The CVSS 3.1 score of 9.9 reflects network exploitability, low attack complexity, no user interaction, a scope change (impact extending beyond the vulnerable component), and high impact on confidentiality, integrity, and availability. All customers running Azure Database for PostgreSQL are potentially affected until remediated. The flaw is not currently listed in CISA's Known Exploited Vulnerabilities catalog and no public proof-of-concept is known.

Do: Check the MSRC advisory and Azure Service Health, and confirm your instances have received Microsoft's service-side fix, as managed Azure databases are typically patched by Microsoft rather than by customer upgrades. Until remediation is confirmed, enforce least-privilege database roles, audit role and admin memberships for unexpected grants, and restrict network exposure using firewall rules, Private Link/Private Endpoints, and VNet integration. Review PostgreSQL audit logs and Microsoft Defender for open-source relational databases alerts for signs of privilege escalation attempts.

CVE-2026-85885 is a command injection flaw (CWE-77) in Microsoft 365 Copilot in which special elements in user-supplied input are improperly neutralized before being passed to a command interpreter. An authorized, low-privileged user can trigger it over the network with crafted input and no user interaction or special conditions. Successful exploitation elevates the attacker's privileges, with high impact to confidentiality, integrity, and availability, and the changed scope in the CVSS vector indicates impact can extend beyond the initially compromised component. Any organization whose users have Microsoft 365 Copilot enabled is in scope, since the flaw resides in Microsoft's cloud service rather than a locally installed product. There is currently no evidence of exploitation in the wild, no public proof-of-concept, and the flaw is not listed in CISA's KEV catalog.

Do: Check the MSRC advisory for CVE-2026-85885 and confirm your tenant has received Microsoft's server-side update, since fixes for the Copilot cloud service are deployed by Microsoft rather than patched locally. In the interim, limit Copilot licenses and access to users who need them and review Microsoft 365 audit logs for unusual privileged actions originating from low-privileged accounts. If the advisory lists any client-side component version to update, apply it promptly.

CVE-2026-85889 is a missing authentication flaw (CWE-306) in Microsoft Azure AI Foundry, meaning a critical function can be reached without any credential check. An unauthenticated attacker can trigger it remotely over a network with no user interaction and no privileges required. Successful exploitation allows the attacker to elevate privileges, and the CVSS scope-change designation (S:C) indicates the impact can extend beyond the initially compromised security authority, with high confidentiality, integrity, and availability impact. Any organization using Azure AI Foundry is potentially affected, though the flaw is in a Microsoft-managed cloud platform rather than a customer-deployed package. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is currently known.

Do: Because Azure AI Foundry is a Microsoft-managed service, monitor Microsoft's security advisory and Azure Service Health for patched status and any customer-required actions rather than applying your own patch. In the meantime, review role assignments, API keys, and network access controls (firewalls, private endpoints, virtual-network restrictions) on your Foundry resources, and check Azure activity logs for unauthenticated or anomalous privilege-related operations. Rotate credentials if suspicious activity is found and watch for updates, as a CVSS 10.0 flaw may draw rapid attacker attention.

CVE-2026-85921 is a double free flaw (CWE-415) in Windows Secure Kernel Mode, the hypervisor-based component that underpins Virtualization-Based Security (VBS) on Windows clients and servers. It is triggered locally by an already-authorized attacker who holds high privileges on the machine (per the CVSS vector, privileges required: high), and successful exploitation lets them elevate privileges across a security boundary — escaping the isolation that Secure Kernel is meant to enforce — with high impact on confidentiality, integrity, and availability. In practice, an attacker with administrative code execution on a VBS-enabled host could leverage the bug to break out of or subvert the secure-kernel boundary and gain deeper, SYSTEM/hypervisor-adjacent control of the system. Any Windows deployment running Secure Kernel Mode (i.e., with VBS/HVCI or Hyper-V-based isolation enabled) is in scope. As of this writing there is no known public proof of concept, and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog.

Do: Apply the Microsoft security update covering this CVE to all VBS/HVCI-enabled Windows clients and servers as soon as it is available, prioritizing servers and privileged workstations where admins and service accounts already hold elevated rights. Because exploitation requires an attacker who already has high local privileges, enforce least-privilege account policies, restrict local administrator membership, and monitor for anomalous activity from privileged processes around virtualization components. After patching, verify VBS/HVCI remains enabled and healthy (e.g., via msinfo32 or Get-CimInstance -ClassName Win32_DeviceGuard) to confirm the secure-kernel protections are intact.

Azure Cosmos DB contains an improper neutralization flaw (CWE-74) in which special elements in attacker-controlled input are passed unneutralized into output consumed by a downstream component, enabling an injection attack. The flaw is triggered over the network by an attacker who already holds a low-privilege, authorized position (such as a legitimate tenant or data-plane account), with no user interaction required. Because the CVSS scope is 'changed', successful exploitation crosses a security boundary, and the attacker gains elevated privileges with high confidentiality and integrity impact (no availability impact). All customers using the managed Azure Cosmos DB service are potentially affected, since fixes must be delivered through Microsoft's service updates. As of this writing, the flaw is not in CISA's KEV catalog and no public proof-of-concept or confirmed in-the-wild exploitation is known.

Do: Monitor Microsoft's advisory and Azure Service Health and ensure your Cosmos DB accounts receive the service-side fix, which is applied by Microsoft rather than by customer patching. In the meantime, apply least privilege to Cosmos DB data-plane and control-plane RBAC roles, audit accounts or integrations that submit user-controlled content into Cosmos DB, and watch logs for anomalous cross-resource or cross-tenant access patterns.