Product:
Azure AI Foundry M365
Summary
Improper access control in Azure AI Foundry M365 published agents allows an unauthorized attacker to elevate privileges over a network. This vulnerability can lead to significant security risks if exploited. Attackers can gain unauthorized access and potentially manipulate sensitive data.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.6 | CVE-2026-35435 |
Exploitation
To exploit this vulnerability, an attacker can leverage the improper access control mechanisms in the Azure AI Foundry M365 published agents. By sending specially crafted requests over the network, the attacker can elevate their privileges without needing any prior authentication or user interaction, allowing them to gain unauthorized access to resources.
Affected Products
- Azure AI Foundry M365 published agents: These agents are vulnerable due to improper access control, allowing unauthorized privilege escalation.
Mitigation
To mitigate this vulnerability, it is essential to apply the latest security updates provided by Microsoft. Additionally, organizations should review their access control policies and ensure that proper authentication mechanisms are in place to prevent unauthorized access.