cve 2026 35435

CVE-2026-35435 is a critical Azure AI Foundry elevation-of-privilege vulnerability affecting Microsoft 365 published agents. Disclosed by Microsoft on May 7, 2026, it stems from improper access control and has a network attack path requiring no privileges or user interaction. Microsoft assessed exploitation as more likely and has already mitigated the issue with no customer action required. The vulnerability highlights architectural concerns around cloud-hosted AI agent services, even after the patch is applied.