This vulnerability (CWE-306) in Azure AI Foundry is due to missing authentication on a critical function, enabling an attacker without prior privileges to elevate their access remotely. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. The vendor advisory confirms the vulnerability is patched with an official fix and that the service is cloud-hosted, meaning Microsoft manages remediation server-side.

An attacker can remotely exploit this vulnerability to gain elevated privileges without authentication, resulting in full compromise of the affected Azure AI Foundry environment. This includes complete loss of confidentiality, integrity, and availability of the service and data.

Microsoft has released an official fix for this vulnerability. As Azure AI Foundry is a cloud service, Microsoft manages the remediation server-side. Users should verify that their environment is updated according to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85889 to ensure protection.