Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-83938

Missing authentication privilege elevation in Azure Kubernetes Configuration Service

CVSS 3.1
10.0 critical
EPSS
—
Published
·
Modified
Analyze CVE-2026-83938 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

Azure Kubernetes Configuration Service is missing authentication on a critical function. An unauthenticated attacker on the network can call it without user interaction and elevate privileges, with impact that can extend beyond the vulnerable component. Organizations using this Microsoft Azure service are affected. Microsoft has not listed affected builds.

What to do: Microsoft has not listed a fixed version for CVE-2026-83938. Apply Microsoft's update for this CVE when it is published.

ProductAffected
Microsoft Azure Kubernetes Configuration Service—
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.

Weakness
CWE-306
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD CVE.org GitHub PoCs EPSS (—)

In the news

0 stories

No ingested article mentions this CVE yet.