Introduction
An improper access control flaw in Microsoft's Azure AI Foundry M365 published agents allowed an unauthenticated, network-based attacker to escalate privileges and breach confidentiality boundaries without any user interaction. The vulnerability has a CVSS 3.1 base score of 8.6 and a "Critical" severity rating from Microsoft. It is notable for its impact profile and also for how it was disclosed. Microsoft published it under its newer transparency initiative, which publicly documents cloud service CVEs even when no customer patch is needed.
Microsoft has already resolved the issue entirely on the server side. Customers have nothing to install or configure. The vulnerability is still worth understanding, especially for organizations that publish AI agents to Microsoft 365 Copilot and Microsoft Teams. It illustrates the kinds of access control risks that emerge when AI agent platforms are deeply integrated into enterprise collaboration surfaces.
Technical Information
Root Cause
CVE-2026-35435 is an improper access control flaw, classified under CWE-284. It existed within the Azure AI Foundry M365 published agents feature, which lets organizations deploy AI agents directly into Microsoft Teams and Microsoft 365 Copilot. The underlying issue was insufficient authorization enforcement in agent-related operations. The platform did not correctly validate privilege boundaries for certain network-accessible requests.
CVSS Vector Breakdown
The full CVSS 3.1 vector string is:
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
Breaking this down:
- Attack Vector (AV:N): The vulnerability is exploitable over the network.
- Attack Complexity (AC:L): Exploitation requires no special conditions or preparation.
- Privileges Required (PR:N): The attacker needs no prior authentication or privileges.
- User Interaction (UI:N): No victim action is needed.
- Scope (S:C): A successful exploit can affect resources beyond the security scope managed by the vulnerable component itself. In practice, the access control failure could let an attacker reach resources that the Azure AI Foundry agent component should not have been able to expose.
- Confidentiality (C:H): High impact on confidentiality. Information access and disclosure protections are compromised.
- Integrity (I:N) and Availability (A:N): Neither integrity nor availability is affected.
The temporal metrics indicate that exploit code maturity is unproven (E:U), an official fix exists (RL:O), and the report is confirmed (RC:C).
Attack Surface
The attack surface is the network-facing interface of Azure AI Foundry M365 published agents. Because these agents are published into Microsoft Teams and Microsoft 365 Copilot, they operate within a collaboration environment that is broadly accessible across an organization. The "changed scope" designation in the CVSS vector means exploitation could allow access to resources outside the agent's own security boundary. With M365 integration, that could mean exposure of data from connected services or of tenant-level information.
Microsoft has not disclosed specific exploit mechanics, detailed attack flow steps, or proof-of-concept code. This is consistent with its handling of exclusively hosted cloud service vulnerabilities, where the fix is deployed transparently and detailed technical specifics are withheld to prevent retroactive exploitation of unpatched edge cases.
Exploitability Assessment
Although there is no known active exploitation, Microsoft categorized this vulnerability's exploitability as "Exploitation More Likely." Given the combination of network accessibility, no authentication requirement, no user interaction, and high confidentiality impact, the assessment is reasonable. The attack prerequisites are minimal, which makes the flaw an attractive target for threat actors seeking unauthorized data access in enterprise environments.
Patch Information
CVE-2026-35435 affects Azure AI Foundry M365 published agents, a cloud-hosted service managed entirely by Microsoft. The service runs exclusively on Microsoft's infrastructure and has no customer-managed components, so Microsoft applied the patch server side, and it has already been fully deployed.
According to the official CVRF data from Microsoft's May 2026 Security Update cycle (retrieved via the MSRC API at api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-May), the vulnerability's remediation status is "Mitigated," with no associated KB article (marked "Not Applicable") and no customer action required. That matches how Microsoft handles security flaws in its exclusively hosted cloud services. It rolls out the fix transparently on the back end, and the advisory is a public disclosure rather than a call to action for administrators.
The remediation tightens access control checks so that privilege boundaries are correctly enforced for agent-related operations. The exact code-level changes are not publicly disclosed, as is typical for proprietary cloud service patches. The fix addresses the insufficient authorization enforcement that previously allowed an unauthenticated, network-based attacker to escalate privileges within the M365 published agents feature.
The CVE was reserved on April 2, 2026 and published on May 7, 2026. That gap indicates Microsoft had sufficient time to develop and deploy the fix before the coordinated disclosure date. The NVD entry corroborates this. It tags the record as exclusively-hosted-service and references the MSRC advisory as the sole remediation source.
If you use Azure AI Foundry M365 published agents, there is nothing to install or update.
Proactive Governance Recommendations
No patch action is required, but organizations using Azure AI Foundry Agent Service should consider the following governance controls:
- Enforce role-based access control through Microsoft Entra and Azure RBAC to limit who can create and publish agents.
- Require Microsoft 365 admin center approval for any agents published to the entire organization.
- Test agents thoroughly in the Foundry portal before publishing to confirm they respond correctly and tools work as expected.
- Avoid including secrets, API keys, or sensitive information in any metadata fields during the publishing process.
Affected Systems and Versions
The affected component is Azure AI Foundry M365 published agents. Microsoft has not provided specific version identifiers or version ranges, which is expected for an exclusively hosted cloud service where versioning is managed internally. The NVD entry tags this record as exclusively-hosted-service. Microsoft has mitigated all instances of the service server side.
Vendor Security History
Microsoft recently updated its Common Vulnerabilities and Exposures program rules to issue CVE records for critical cloud service vulnerabilities. Under the new policy, vulnerabilities with the potential to cause significant harm receive public documentation, whether or not customers need to install a patch or take other actions. CVE-2026-35435 was published under this transparency framework, which is a meaningful step forward in cloud security accountability. Microsoft maintains the Microsoft Security Response Center (MSRC) to investigate and resolve security vulnerabilities across its entire product portfolio.
References
- NVD Entry for CVE-2026-35435
- MSRC Security Update Guide: CVE-2026-35435
- MSRC CVRF Data for May 2026
- CVE Record: CVE-2026-35435
- RedPacket Security Alert: CVE-2026-35435
- Microsoft: Toward Greater Transparency, Unveiling Cloud Service CVEs
- Publish Agents to Microsoft 365 Copilot and Microsoft Teams
- What is Microsoft Foundry Agent Service?
- What is Microsoft Foundry?
- Introducing the New Hosted Agents in Foundry Agent Service
