Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Azure AI. Show all posts
Privilege Escalation
Azure AI Cloud Security Cyber Security Microsoft Azure Privilege Escalation

Microsoft Fixes Critical Azure AI Flaw Rated CVSS 10.0

 

Microsoft has patched a maximum-severity vulnerability in Azure AI Foundry that could allow unauthorized attackers to escalate their privileges over a network. Tracked as CVE-2026-85889, the flaw carries a CVSS score of 10.0, making it one of the most serious security issues affecting Microsoft’s cloud-based artificial intelligence services. The company said the vulnerability resulted from missing authentication for a critical function within Azure AI Foundry. There is currently no evidence that the flaw has been exploited in real-world attacks. 

Azure AI Foundry, also known as Microsoft Foundry, is an enterprise platform used to build, deploy and manage generative AI applications and autonomous agents. A successful exploit could have enabled an unauthorized attacker to gain elevated privileges, potentially increasing access to sensitive resources or administrative functions. Security researcher Rémy Marot, who uses the handle @R_Marot, discovered and reported the vulnerability to Microsoft. The company has already addressed the issue across its cloud infrastructure. 

Microsoft said customers do not need to take any action because the affected cloud services have been fully mitigated. Alongside CVE-2026-85889, the company also fixed several other critical cloud vulnerabilities. These include CVE-2026-85885, a command injection flaw in Microsoft 365 Copilot rated 9.9; CVE-2026-85878, an improper authorization issue in Azure Database for PostgreSQL rated 9.9; and CVE-2026-87701, an improper neutralization vulnerability in Azure Cosmos DB rated 9.6. 

The tech giant separately released updates for two Windows vulnerabilities. CVE-2026-62721 affects the Windows User-Mode Power Service and could allow an authorized local attacker to gain SYSTEM privileges. CVE-2026-85921 is a double-free vulnerability in Windows Secure Kernel Mode that could enable privilege escalation to Virtual Trust Level 1. Both vulnerabilities were fixed through an out-of-band update for Windows 11 version 26H1, distributed as cumulative update KB5129194 for arm64 and x64 systems. 

The latest fixes arrive shortly after Microsoft patched 974 vulnerabilities across its software portfolio. Two of those flaws, affecting Windows Advanced Local Procedure Call and the Windows Update Stack, were reportedly exploited in active attacks. Proofpoint and Volexity said the ALPC flaw was chained with two Google Chrome vulnerabilities to create the BlueMoon exploit kit, which multiple espionage-linked threat actors allegedly used to deliver malicious payloads. The developments highlight the growing security risks surrounding cloud platforms, enterprise AI tools and widely deployed operating systems.
Read more »
Technology
AI technology Artificial Intelligence Azure AI D-ID Digital Avatar Lip sync technology Microsoft natural language AI Synthesia Technology

Microsoft Announces Launch of Customizable AI-Powered Digital Avatar


Microsoft has recently announced the launch of its text-to-speech avatars on its Azure AI platform, which will enable businesses to design customized digital humans driven by natural language AI. With the new avatars, word input may be used to initiate interactive experiences and photorealistic avatar videos. Custom virtual assistants, instructional films, digital doubles, and other items can be created by users.

Introduced in the recently held Microsoft Ignite, these avatars incorporate text-to-speech models with computer vision advances. In order to train a personalized avatar, users can upload a few pictures and video samples of themselves. The AI technology matches the person's voice and likeness with exceptional fidelity by accurately mimicking lip motions and vocal intonations.

High-quality video content generally takes a lot of time and money. Microsoft, however, is making the bold assumption that its text-to-speech avatars will make it possible to create dynamic talking digital anchors, brand spokesmen, tutorial instructors, and other virtual characters more quickly and affordably.

Also, the avatars will provide a more natural conversation experience with AI assistants. Microsoft demonstrated an avatar shopping assistant that uses Azure AI search and database capabilities to handle inquiries and carry out transactions in real time.

Neural rendering and strong voice cloning are used by the avatar creator internally. The technology creates a phonetic sequence by first analyzing the supplied text. After that, Azure's cutting-edge neural text-to-speech engine synthesizes voice with remarkable accuracy by predicting acoustic features. Lastly, the avatar animation model creates photorealistic facial emotions and lip sync using those traits.

Prebuilt and customized text-to-speech avatars are the two variations of this capability that Azure AI Speech offers. With the prebuilt option, users may create standard video content and interactive applications with ready-made avatars in multiple languages and voices. On the other hand, the customized capability enables the production of unique avatars from customer-supplied video footage.

As of new, access to these customizable avatars is restricted in order to reduce the risks of deepfakes. However, Speech Studio tools make pre-built avatar alternatives available to all Azure customers.

Competitors of Microsoft

Certainly, Microsoft is not the only organization trying its hands on AI synthetic media, with them facing competition with D-ID and Synthesia which are already generating avatars on a large scale. 

Furthermore, although innovative in its own way, Microsoft's avatar technology is deficient in many of its features. For instance, unlike Microsoft's text-dependent method, D-ID and Synthesia enable avatar construction from both text and audio input. Additionally, D-ID offers user-friendly smartphone apps for creating avatars, while Synthesia's self-service studio facilitates large-scale video production.

Currently, the quality of lip-sync provided by Microsoft’s avatar is seemingly not at its best when compared with the realism achieved by Synthesia and D-ID.

Nonetheless, Microsoft has a competitive edge in speech AI research, large language model technologies, and enterprise cloud resources. With the support of Azure's processing capacity, the tech giant is wagering that its expertise in natural language systems will open up new use cases and advance avatar innovation.  

Read more »
Subscribe to: Posts (Atom)