This vulnerability in Microsoft Azure AI Foundry arises from improper access control in M365 published agents, enabling unauthorized privilege escalation remotely over a network. The CVSS 3.1 vector indicates the attack requires no privileges or user interaction, has low attack complexity, and impacts confidentiality with a scope change. Microsoft manages remediation for this cloud-hosted service and has released an official fix as per their advisory.

An attacker can elevate privileges without authentication or user interaction, potentially gaining high confidentiality impact over the Azure AI Foundry environment. This could lead to unauthorized access to sensitive data or control within the service. Availability and integrity impacts are not indicated.

Microsoft has released an official fix for this vulnerability and manages remediation for the Azure AI Foundry cloud service. Users should ensure their Azure AI Foundry service is updated per Microsoft's guidance in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35435. No additional action is required beyond applying the official fix.