CVE-2026-35435 is an improper access control vulnerability (CWE-284) affecting Microsoft Azure AI Foundry's M365 published agents. The flaw permits unauthorized attackers to elevate their privileges remotely over a network without requiring user interaction. The vulnerability is rated high severity with a CVSS 3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N). Microsoft has issued an official fix and manages patching for this cloud-hosted service. No known active exploitation has been reported.

Successful exploitation allows an attacker to gain elevated privileges remotely on Azure AI Foundry components, potentially compromising confidentiality at a high level. The vulnerability does not impact integrity or availability directly. Given the cloud service nature, the impact is primarily on the affected Azure AI Foundry environment and its data confidentiality.

Microsoft has provided an official fix for this vulnerability and manages remediation for the Azure AI Foundry cloud service. Customers should verify that their Azure AI Foundry instances are updated according to Microsoft's guidance in the official advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35435. No additional customer action is typically required beyond ensuring the service is current.