Microsoft has disclosed fixes for 18 security vulnerabilities affecting Azure, Copilot and other cloud services, including several flaws the company rates as Critical.
The affected products include Azure AI Foundry, Azure Cosmos DB, Azure Logic Apps, Azure Arc, Azure Machine Learning, Azure Container Registry, Azure Billing, Azure HorizonDB, Microsoft Fabric and Microsoft Dataverse. Vulnerabilities were also disclosed in Microsoft Copilot, Microsoft 365 Copilot and Microsoft 365 Copilot Business Chat.
Microsoft says the fixes were applied to its cloud infrastructure and do not require customers to install updates or take other action. None of the vulnerabilities have been identified as being actively exploited.
Azure AI Foundry Among the Affected Services
Two of the vulnerabilities affect Azure AI Foundry, Microsoft’s platform for building and managing AI applications and agents.
One of them, CVE-2026-85889, involves missing authentication for a critical function and could allow an unauthenticated attacker to gain elevated privileges over a network.
A second Azure AI Foundry vulnerability, CVE-2026-85917, also involves elevation of privilege.
Most of the Flaws Involve Elevated Access
Elevation-of-privilege vulnerabilities account for most of the 18 disclosures.
These types of flaws can allow someone with limited or unauthorized access to gain permissions they should not have.
Affected services include Azure Cosmos DB, Azure Logic Apps, Azure Arc, Azure Container Registry, Azure Billing, Azure HorizonDB, Microsoft Fabric, Microsoft Dataverse and Microsoft 365 Copilot.
Microsoft also fixed information-disclosure vulnerabilities affecting Microsoft Copilot, Microsoft 365 Copilot, Microsoft 365 Copilot Business Chat and Azure Machine Learning. Such vulnerabilities can potentially expose information that should not be available to the attacker.
Azure Portal was affected by a separate spoofing vulnerability.
The individual vulnerabilities vary in severity and in the level of access or other conditions required for exploitation.
Because the affected products are hosted services operated by Microsoft, customers generally do not download and install patches for them as they would for software running on a computer or server. Microsoft has deployed the fixes directly to the systems running the services.
Leave a Reply