diff --git a/src/azure-cli-core/HISTORY.rst b/src/azure-cli-core/HISTORY.rst
index db4ce38ca3f..5e642ee1792 100644
--- a/src/azure-cli-core/HISTORY.rst
+++ b/src/azure-cli-core/HISTORY.rst
@@ -3,6 +3,16 @@
 Release History
 ===============
 
+2.85.0
+++++++
+* Resolve CVE-2026-26007 (#32879)
+* `az *`: Make `--acquire-policy-token` and `--change-reference` global arguments available by default, removing the need for `core.enable_policy_token` configuration (#32883)
+* Resolve CVE-2026-27448 (#33035)
+* Resolve CVE-2026-27459 (#33035)
+* Resolve CVE-2026-32597 (#33034)
+* Resolve CVE-2026-25645 (#33081)
+* Resolve CVE-2026-34073 (#33099)
+
 2.84.0
 ++++++
 * Minor fixes
diff --git a/src/azure-cli-core/azure/cli/core/__init__.py b/src/azure-cli-core/azure/cli/core/__init__.py
index 4fa55c0bfd4..33cdd4b8e37 100644
--- a/src/azure-cli-core/azure/cli/core/__init__.py
+++ b/src/azure-cli-core/azure/cli/core/__init__.py
@@ -4,7 +4,7 @@
 # --------------------------------------------------------------------------------------------
 # pylint: disable=line-too-long
 
-__version__ = "2.84.0"
+__version__ = "2.85.0"
 
 import os
 import sys
diff --git a/src/azure-cli-core/azure/cli/core/commandIndex.latest.json b/src/azure-cli-core/azure/cli/core/commandIndex.latest.json
index 51a8da53a2d..a19c75ad8e7 100644
--- a/src/azure-cli-core/azure/cli/core/commandIndex.latest.json
+++ b/src/azure-cli-core/azure/cli/core/commandIndex.latest.json
@@ -1,5 +1,5 @@
 {
-  "version": "2.84.0",
+  "version": "2.85.0",
   "cloudProfile": "latest",
   "commandIndex": {
     "account": [
diff --git a/src/azure-cli-core/azure/cli/core/helpIndex.latest.json b/src/azure-cli-core/azure/cli/core/helpIndex.latest.json
index 616fcee61d5..dccb37a9970 100644
--- a/src/azure-cli-core/azure/cli/core/helpIndex.latest.json
+++ b/src/azure-cli-core/azure/cli/core/helpIndex.latest.json
@@ -1,5 +1,5 @@
 {
-  "version": "2.84.0",
+  "version": "2.85.0",
   "cloudProfile": "latest",
   "helpIndex": {
     "groups": {
diff --git a/src/azure-cli-core/setup.py b/src/azure-cli-core/setup.py
index bb1bc888b19..2411f8005d8 100644
--- a/src/azure-cli-core/setup.py
+++ b/src/azure-cli-core/setup.py
@@ -8,7 +8,7 @@
 from codecs import open
 from setuptools import setup, find_packages
 
-VERSION = "2.84.0"
+VERSION = "2.85.0"
 
 # If we have source, validate that our version numbers match
 # This should prevent uploading releases with mismatched versions.
diff --git a/src/azure-cli/HISTORY.rst b/src/azure-cli/HISTORY.rst
index cdcaec7ae19..882d73f54aa 100644
--- a/src/azure-cli/HISTORY.rst
+++ b/src/azure-cli/HISTORY.rst
@@ -3,6 +3,96 @@
 Release History
 ===============
 
+2.85.0
+++++++
+
+**ACR**
+
+* `az acr network-rule add`: Add example of adding a rule to allow access for a specific virtual network (#32829)
+* `az acr replication create/update`: Add `--global-endpoint-routing` parameter and redirect `--region-endpoint-enabled` to it to avoid confusion with registry-level `--regional-endpoints` (#32954)
+* `az acr cache create/update`: Add `--identity` parameter to support using user-assigned managed identity for cache rules (#33040)
+
+**AKS**
+
+* Fix #32957: `az aks get-credentials`: Surface user-friendly error instead of unexpected traceback (#32959)
+* `az aks create/update`: Add `--acns-transit-encryption-type` parameter to support configuring pod-to-pod transit encryption (`WireGuard` or `None`) (#32988)
+* `az aks create/update` Add support for ACNS performance (#33018)
+* `az aks namespace update`: Fix the location logic for managed namespace update operation (#33054)
+* `az aks update`: Add `--enable-high-log-scale-mode` parameter to enable/disable High Log Scale Mode for Container Logs (#33039)
+* `az aks enable-addons`: Fix monitoring addon key lookup to handle both `omsagent` and `omsAgent` API response variants (#33039)
+* `az aks disable-addons`: Add retry with exponential backoff for Log Analytics workspace creation conflicts (#33039)
+* `az aks update`: Add `--disable-http-proxy` and `--enable-http-proxy` parameters (#32996)
+
+**API Management**
+
+* `az apim backend`: Add new command group to support backend services (#32569)
+
+**App Config**
+
+* `az appconfig create/update`: Enable linking app insights resource to an app configuration store (#32831)
+* `az appconfig feature set`: Enable telemetry for a feature flag (#32831)
+
+**App Service**
+
+* `az webapp list-runtimes`: Pre-announce breaking changes (#32905)
+* `az logicapp create`: Add parameter `--domain-name-scope` to support specifying the scope of uniqueness for the default hostname during resource creation (#32812)
+* `az webapp update`: Add parameter `--platform-release-channel` to support setting the platform release channel for the web app (#32811)
+* `az appservice plan update`: Remove preview flag for `--elastic-scale` and `--max-elastic-worker-count` parameters (#32807)
+* `az webapp update`: Remove preview flag for `--minimum-elastic-instance-count` and `--prewarmed-instance-count` parameters (#32807)
+* `az webapp up`: Add parameter `--domain-name-scope` to support specifying the scope of uniqueness for the default hostname during resource creation (#32930)
+
+**Cloud**
+
+* Add Bleu to the Known Clouds list (#32856)
+
+**Compute**
+
+* `az vmss create`: Add `--zone-placement-policy` parameter to enable automatic zone selection (#32771)
+* `az vmss create`: Add `--include-zones` parameter to support specifying availability zones that must be considered for placement when `--zone-placement-policy` is set to `Auto` (#32771)
+* `az vmss create`: Add `--exclude-zones` parameter to support specifying availability zones that must be excluded from placement when `--zone-placement-policy` is set to `Auto` (#32771)
+* `az vmss create`: Add `--max-zone-count` parameter to support specifying the maximum number of availability zones to use when `--zone-placement-policy` is set to `Auto` (#32771)
+* `az vmss update`: Add `--max-zone-count` parameter to support specifying the maximum number of availability zones to use for this scale set (#32771)
+* `az vmss create/update`: Add `--value-max-instance-percent-per-zone` parameter to support specifying the maximum percentage of virtual machine instances that can be allocated to a single availability zone in the virtual machine scale set (#32771)
+* `az vmss create/update`: Add `--instance-percent-policy` parameter to support specifying whether maximum percentage of virtual machine instances per zone policy should be enabled on the virtual machine scale set (#32771)
+* `az vm run-command invoke`: Fix `--no-wait` not working (#32979)
+* `az restore-point collection create/update`: Add parameter `--instant-access` (#32953)
+* `az restore-point create`: Add parameter `--instant-access-duration` (#32953)
+
+**Container app**
+
+* `az containerapp env workload-profile add`: Simplify workload-profile creation with default profile name (#32713)
+
+**Event Hubs**
+
+* Fix #31108, #32073: `az eventhubs`: Regex updated for commands with `--namespace-name` arguments (#32472)
+
+**NetAppFiles**
+
+* `az netapfiles volume create/update`: Add paramter `--desired-ransomware-protection-state` to support advanced ransomware reports (#32828)
+* `az netapfiles volume ransomware-report`: Add command group to support advanced ransomware reports (#32828)
+* `az netapfiles volume list-quota-report`: Add command to list quota reports for volumes (#32828)
+
+**Network**
+
+* `az network private-endpoint-connection`: Add provider `Microsoft.DurableTask/schedulers` (#32866)
+* `az network private-endpoint create/update`: Add parameter `--ip-version-type` to support IPv6 (#32937)
+
+**Packaging**
+
+* Add new ways (preview) to install azure-cli on macOS (#32880)
+
+**PostgreSQL**
+
+* `az postgres flexible-server long-term-retention`: Add breaking change announcement for command group removal (#32916)
+
+**Storage**
+
+* Fix #32852: `az storage copy`: Fix Azcopy download link to be using github release links (#32868)
+
+**Synapse**
+
+* Upgrade azure-synapse-artifacts to 0.22.0 (#33012)
+
 2.84.0
 ++++++
 
diff --git a/src/azure-cli/azure/cli/__main__.py b/src/azure-cli/azure/cli/__main__.py
index de4e974b58d..b55f12d5721 100644
--- a/src/azure-cli/azure/cli/__main__.py
+++ b/src/azure-cli/azure/cli/__main__.py
@@ -17,7 +17,7 @@
 from knack.log import get_logger
 
 __author__ = "Microsoft Corporation <python@microsoft.com>"
-__version__ = "2.84.0"
+__version__ = "2.85.0"
 
 
 logger = get_logger(__name__)
diff --git a/src/azure-cli/requirements.py3.Darwin.txt b/src/azure-cli/requirements.py3.Darwin.txt
index 14a58689fc5..6c0a4f50c63 100644
--- a/src/azure-cli/requirements.py3.Darwin.txt
+++ b/src/azure-cli/requirements.py3.Darwin.txt
@@ -4,9 +4,9 @@ argcomplete==3.5.2
 asn1crypto==0.24.0
 azure-appconfiguration==1.7.2
 azure-batch==15.0.0b1
-azure-cli-core==2.84.0
+azure-cli-core==2.85.0
 azure-cli-telemetry==1.1.0
-azure-cli==2.84.0
+azure-cli==2.85.0
 azure-common==1.1.22
 azure-core==1.39.0
 azure-cosmos==3.2.0
diff --git a/src/azure-cli/requirements.py3.Linux.txt b/src/azure-cli/requirements.py3.Linux.txt
index 65532d71e06..b8bd4e1c701 100644
--- a/src/azure-cli/requirements.py3.Linux.txt
+++ b/src/azure-cli/requirements.py3.Linux.txt
@@ -4,9 +4,9 @@ argcomplete==3.5.2
 asn1crypto==0.24.0
 azure-appconfiguration==1.7.2
 azure-batch==15.0.0b1
-azure-cli-core==2.84.0
+azure-cli-core==2.85.0
 azure-cli-telemetry==1.1.0
-azure-cli==2.84.0
+azure-cli==2.85.0
 azure-common==1.1.22
 azure-core==1.39.0
 azure-cosmos==3.2.0
diff --git a/src/azure-cli/requirements.py3.windows.txt b/src/azure-cli/requirements.py3.windows.txt
index 6455b6d76d4..61885e9af05 100644
--- a/src/azure-cli/requirements.py3.windows.txt
+++ b/src/azure-cli/requirements.py3.windows.txt
@@ -4,9 +4,9 @@ argcomplete==3.5.2
 asn1crypto==0.24.0
 azure-appconfiguration==1.7.2
 azure-batch==15.0.0b1
-azure-cli-core==2.84.0
+azure-cli-core==2.85.0
 azure-cli-telemetry==1.1.0
-azure-cli==2.84.0
+azure-cli==2.85.0
 azure-common==1.1.22
 azure-core==1.39.0
 azure-cosmos==3.2.0
diff --git a/src/azure-cli/setup.py b/src/azure-cli/setup.py
index b16d8be4dc8..fc8b6d736fd 100644
--- a/src/azure-cli/setup.py
+++ b/src/azure-cli/setup.py
@@ -17,7 +17,7 @@
     logging.warning("Wheel is not available, disabling bdist_wheel hook")
     cmdclass = {}
 
-VERSION = "2.84.0"
+VERSION = "2.85.0"
 # If we have source, validate that our version numbers match
 # This should prevent uploading releases with mismatched versions.
 try: