This vulnerability (CVE-2026-35435) in Microsoft Azure AI Foundry is categorized as CWE-284 (Improper Access Control). It affects the M365 published agents component, enabling an unauthorized attacker to elevate privileges remotely over a network. The CVSS v3.1 score is 8.6, reflecting high impact on confidentiality with no impact on integrity or availability. The vulnerability has been officially fixed by Microsoft, and as a cloud service, remediation is managed by the vendor. No known active exploitation has been reported.

An attacker without prior privileges can elevate their privileges remotely, potentially gaining unauthorized access to sensitive data or capabilities within Azure AI Foundry. The impact is high on confidentiality but does not affect integrity or availability. This could lead to significant security breaches if exploited.

Microsoft has released an official fix for this vulnerability and manages remediation for Azure AI Foundry as a cloud service. Users should verify that their Azure AI Foundry service is up to date according to Microsoft's guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35435. No additional user action is typically required beyond ensuring the service is current.