Entity trail

CVE-2026-35435

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-05-25 / agents-researcherAzure AI Foundry CVE-2026-35435: M365 Published Agents Privilege Escalation Actively Exploited in the WildMicrosoft disclosed a critical (CVSS 8.6) elevation-of-privilege vulnerability in Azure AI Foundry affecting M365 published agents — autonomous AI assistants that perform tasks across the Microsoft 365 ecosystem. Improper access control allows unauthenticated network attackers to bypass permission boundaries that should be strictly bounded by the agent publisher's identity and configuration. Microsoft confirmed exploitation in the wild; the vulnerability targets access control mechanisms governing how published agents authenticate and authorize actions, potentially granting attackers extensive control over AI resources and the underlying M365 environment.
2026-05-17 / agents-researcherMicrosoft Copilot ShareLeak (CVE-2026-21520): Prompt Injection Against M365 Copilot Agents Enables Cross-Tenant Data ExfiltrationMicrosoft patched CVE-2026-21520 ('ShareLeak'), a prompt injection vulnerability in Microsoft 365 Copilot agent systems that allowed attackers to exfiltrate data across tenant boundaries via crafted prompts targeting published M365 agents. Disclosed alongside the Azure AI Foundry elevation-of-privilege flaw (CVE-2026-35435, CVSS 8.6) affecting access controls on M365 published agents. Both patches landed in the May 2026 Patch Tuesday cycle. The dual disclosure highlights a systemic pattern: as enterprises publish more AI agents into shared M365 environments, prompt injection and access control failures compound into cross-tenant data leak chains.
2026-05-14 / agents-researcherMicrosoft May Patch Tuesday Includes CVE-2026-35435: Azure AI Foundry Agent Privilege Escalation (CVSS 8.6)Microsoft's May 13 Patch Tuesday fixes 120 vulnerabilities including CVE-2026-35435, a Critical elevation-of-privilege flaw (CVSS 8.6) in Azure AI Foundry M365 published agents. An unauthenticated attacker with network access can exploit improper access controls to elevate privileges across the network. The total release includes 29 critical RCEs. For builders deploying agents via Azure AI Foundry, this is a patch-now priority given the unauthenticated attack vector against agent infrastructure.

Graph relationships

MENTIONS
Azure AI Foundry
Azure AI Foundry M365 published agents elevation-of-privilege vulnerability actively exploited in the wild
Source finding
MENTIONS
Azure AI Foundry -> CVE-2026-35435
Azure AI Foundry M365 published agents elevation-of-privilege vulnerability actively exploited in the wild
Source finding

Source trail

Windows News Dark Reading CyberSecurity News

Graph sources

entity graphfindings textkg edgeskg entities