AI SecurityVulnerability ManagementCompliance
Most vulnerability advisories come with a job attached. Find the affected versions, schedule the patch, confirm it landed, close the ticket. The work is tedious, but at the end of it you know where you stand.
On 17 September Microsoft published an advisory with no job attached. CVE-2026-85889 is a flaw in Azure AI Foundry, the platform many enterprises use to build, deploy and manage generative AI applications and agents. It carries a CVSS score of 10.0, the maximum. Microsoft's advisory says the service had been fixed on its own infrastructure and that customers need to do nothing.
That is good news. It also leaves security teams with an awkward question: if you could not have patched it, what could you have done?
According to Microsoft's advisory, as reported by The Hacker News and Cyber Security News, the issue is a missing authentication for critical function (CWE-306). A backend function that should have required a verified, privileged caller didn't check. The advisory says it "allows an unauthorized attacker to elevate privileges over a network."
The CVSS vector explains the 10.0:
Successful exploitation would have given an attacker the control of a legitimate privileged user. On a platform that holds model deployments, the data connected to them, and the agents built on top, that is a lot of access.
The flaw was reported by researcher Rémy Marot. Microsoft says it has seen no exploitation in the wild and no public proof-of-concept exists.
The same batch of cloud advisories included more critical-rated issues in services that sit close to enterprise data:
| CVE | CVSS | Service |
|---|---|---|
| CVE-2026-85889 | 10.0 | Azure AI Foundry: missing authentication, privilege escalation |
| CVE-2026-85885 | 9.9 | Microsoft 365 Copilot: command injection, privilege escalation |
| CVE-2026-85878 | 9.9 | Azure Database for PostgreSQL: improper authorization |
| CVE-2026-87701 | 9.6 | Azure Cosmos DB: improper neutralization |
Two of the four are AI services. We looked at a different Copilot issue in August, CoSnitch, where the fix also sat entirely on Microsoft's side.
Microsoft began issuing CVEs for cloud service vulnerabilities in 2024, including ones customers can't act on. That is a good practice. Before it, a flaw like this could be fixed quietly and never disclosed. Now it gets an identifier, a score and a public description.
What the CVE can't give you is the thing you usually get from a patch: evidence about your own environment. For self-hosted software, the patch cycle doubles as an inventory check. Finding the vulnerable versions tells you where the software runs, and confirming the fix tells you the exposure is closed. For a managed AI platform, both steps happen on the provider's side. The advisory tells you the window has closed. It doesn't tell you how long it was open, or whether anything in your tenant was touched while it was.
"No evidence of exploitation" is the provider's assessment based on the provider's telemetry. It is probably right. But it is the only assessment available, and it comes from the same party that shipped the flaw. We made a related point earlier this week about stolen API keys. When the evidence lives only in a provider's logs, you depend on the provider to interpret it for you.
None of this is a reason to avoid managed AI platforms. Microsoft almost certainly fixed this faster and more completely than most customers could have fixed a self-hosted equivalent. The point is narrower. For the AI platforms you rent, your security posture is made of the decisions you control, and those decisions are made before an advisory like this one appears.
The boundary first. Obiguard Governance AI does not sit in front of Azure AI Foundry's management plane. It could not have detected or blocked an attack on the vulnerable function, and it has no view of the Foundry projects, connections or stored data an attacker could have reached. Only Microsoft could close that hole, and it has.
What Governance AI covers is steps 3 to 5: the model traffic your applications and agents send to AI providers, including Azure OpenAI, when it is routed through the Governance AI gateway.
A record that isn't the provider's. The Audit Ledger logs every prompt, response and tool call that passes through the gateway, with the model called, the agent ID and the user or service account behind it. Every policy decision is logged next to it. Records can't be edited or deleted, and they can be streamed to Splunk, Sumo Logic, Datadog or any SIEM via webhook or S3. After an advisory like CVE-2026-85889, "what did we send to that platform, and when?" becomes a query you can run yourself, not a question you have to ask the vendor.
Less sensitive data reaching the endpoint. Inspection scans prompts in-path, before they reach the model, for personal data such as names, emails, phone numbers, IBANs, passport and credit card numbers. Depending on the policy set, a match is blocked or flagged. Responses are inspected before delivery too, and can be redacted, blocked or flagged, with the original kept in the ledger. That doesn't make a platform flaw harmless. It reduces how much of your regulated data was ever sitting on the other side of it.
Supplier risk you can show an auditor. Framework Mapping shows how your policies, controls and violations line up against NIST AI RMF, ISO/IEC 42001, OWASP LLM Top 10, Malaysia's AISCF and Singapore's MGF for GenAI, and marks each category covered, partial or not covered. It is a self-assessment aid, not a certification. When the question after a supplier advisory is "what controls did we have around this?", the answer is a page with the evidence behind it, not a meeting.
One more practical point. The gateway works with OpenAI, Anthropic, Bedrock, Vertex AI, Azure OpenAI and any OpenAI-compatible endpoint, so these controls stay the same when an application moves from one provider to another. Your record and your policies belong to you, not to the platform the traffic happens to go to this quarter.
The patch cycle was never only about patching. It was also how security teams stayed in touch with their own exposure. Managed AI platforms remove that cycle, mostly for the better, but the awareness it used to create has to come from somewhere else.
CVE-2026-85889 is fixed, and there is no sign anyone used it. The next advisory might say the same, or it might not. Either way, the useful question isn't was the provider vulnerable? It is: if the provider told you tomorrow that it had been, how quickly could you say what you had sent it, and what it could reach?
Explore Governance AI or talk to us about keeping your own record of the AI platforms you depend on.
Obiguard sits in front of every AI request your organization makes — screening prompts and outputs against the guardrails, compliance frameworks, and audit trails that stories like this one make necessary.
See how it works →