Executive Summary
Microsoft fixed 18 cloud vulnerabilities in its September round, and the top of the list is a missing authentication check in Azure AI Foundry scored CVSS 10.0. Elevation of privilege carried the batch. Four flaws scored 9.6 or higher, reaching Azure Cosmos DB, Azure Database for PostgreSQL, Microsoft 365 Copilot and the Foundry platform itself. The same update names Azure Arc, Azure Container Registry, Azure Logic Apps, Microsoft Fabric, Dataverse, Copilot Business Chat and Azure Machine Learning. None were exploited in the wild, and every cloud fix was applied on Microsoft’s side.
The pattern matters more than the list. The most severe bugs here sit in the AI control plane, not the hypervisor or the kernel, and they are the class of flaw that keeps surfacing in cloud services, a trusted endpoint that never checked who was calling. Microsoft’s answer is that customers take no action. That is a real benefit and a real blind spot, because a server-side patch also removes the evidence you would use to confirm it landed. The control worth having is not patching. It is knowing which AI services your workloads can reach and what identity they carry when they arrive.
Patch Tuesday is the part of Microsoft’s security calendar everyone can see. The cloud side is the part nobody gets to run, and this month the cloud side carried the higher numbers.
The highest score in the batch was a missing authentication check
Azure AI Foundry is Microsoft’s platform for building, deploying and managing generative AI applications and agents. CVE-2026-85889 is described as a missing authentication for critical function, which let an unauthorized attacker elevate privileges over a network. The National Vulnerability Database carries the Azure AI Foundry vulnerability at a score of 10.0. Microsoft credited researcher Rémy Marot for the report and said there is no evidence of exploitation.
Two more flaws landed at 9.9. CVE-2026-85885 is a command injection in Microsoft 365 Copilot. CVE-2026-85878 is an improper authorization in Azure Database for PostgreSQL. CVE-2026-87701 is an improper neutralization in Azure Cosmos DB at 9.6. The batch also reaches Azure Arc, the service that projects Kubernetes clusters and bare metal into Azure management, and Azure Container Registry, which many teams treat as a private vault for their images.
Every cloud fix landed on the vendor’s side
SecurityWeek reported that Microsoft rated all 18 as critical, though the scores themselves spread from medium to maximum. The Hacker News noted the fixes were already mitigated and needed nothing from the customer. None were flagged as exploited.
That is the cloud model working as advertised, and it is also the part you cannot audit. On a hypervisor you patch, then you check the version string and you are done. On a managed service you accept the vendor’s word, and the gap between publication and mitigation stays invisible from your side. It matters more than usual for the products in this batch, because an AI control plane is not a database you own. It is a platform holding credentials into everything your agents can touch.
One item in the same window did require action. CVE-2026-85921 is a double free in the Windows Secure Kernel Mode that can reach Virtual Trust Level 1, and it shipped as an out-of-band update. That is the older model, and it is the one where you can prove the fix.
What you control when you cannot patch
You cannot patch an Azure endpoint. You can shrink what a compromised one would reach. Start with stale access. Every AI Foundry project, Copilot agent and service principal that still holds a role from a pilot that ended is standing access to the same things this vulnerability protected.
Then ask the boring question about identity. Which roles does each AI service hold, and what can those roles read. Azure Arc and Azure Container Registry both appear in this batch, and both tend to carry broad permissions because somebody was moving fast during a migration. Narrowing them is a change you own end to end, and it is the part of this story a vendor cannot do for you.
Related reading. We covered the client-side half of this month in Microsoft’s record Patch Tuesday, and the kernel bugs that landed the same week in four Linux root flaws at once.
Get the next one before it is old news
Independent analysis of cloud-native infrastructure, Kubernetes and data centre economics. No vendor spin.