Improper access control in Azure AI Foundry M365 published agents allows an unauthorized attacker to elevate privileges over a network. The vulnerability enables a non‑privileged user, by exploiting the lack of proper authorization checks, to gain higher level access and potentially access sensitive data or control services.

Microsoft Azure AI Foundry is the affected product. No specific version information is provided in the advisory, so all deployed instances of Azure AI Foundry may be vulnerable until a patch is released.

The CVSS score of 8.6 indicates a high severity vulnerability. EPSS data is not available, but the lack of KEV listing suggests no confirmed exploitation yet. The likely attack vector is a network‑based approach, where an attacker interacting with the M365 published agents can trigger the privilege escalation. If exploited, an attacker could gain unauthorized administrative capabilities within the Azure AI Foundry environment.