Microsoft released fixes for a maximum-severity flaw in Azure AI Foundry that could enable privilege escalation, tracked as CVE-2026-85889 with a CVSS score of 10.0, requiring no customer action. Microsoft said the missing authentication for critical function allows an unauthorized attacker to elevate privileges over a network, crediting researcher Rémy Marot (@R_Marot), with no evidence of exploitation in the wild. Microsoft also patched CVE-2026-85885 (CVSS score: 9.9), a command injection in Microsoft 365 Copilot; CVE-2026-85878 (CVSS score: 9.9), improper authorization in Azure Database for PostgreSQL; and CVE-2026-87701 (CVSS score: 9.6), improper neutralization in Azure Cosmos DB, all allowing an authorized attacker to elevate privileges over a network. Microsoft said the cloud vulnerabilities were fully mitigated with no user action required. Separately, Microsoft shipped updates for CVE-2026-62721 (CVSS score: 7.8), insufficient granularity of access control in Windows User-Mode Power Service (UMPS) enabling local privilege escalation to SYSTEM, and CVE-2026-85921 (CVSS score: 8.2), a double free in Windows Secure Kernel Mode enabling local elevation to Virtual Trust Level 1 (VTL1) privileges, as part of an out-of-band update