CVE-2026-83938
Azure Kubernetes Configuration Service Elevation of Privilege Vulnerability
Microsoft Azure Kubernetes Configuration ServiceContainers & cloud
CVSS
10.0CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.67%Chance of exploitation activity in the next 30 days, higher than 51% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Vendor and government advisories 1
Vendors that say their products are affected, and agencies that issued alerts. Check each for the fixed release of the product you run.
Reports 2
2 outlets mention it. Reports are not confirmation; each links to its source.
- @threatroundup.bsky.social: 🚨 Critical: CVE-2026-83938 in Microsoft Azure Kubernetes Configuration Service, CVSS 10.0. Missing authentication for critical function in Azure Kubernetes Configuration Service alBluesky: CVE posts, 24 Oct 2026
- CVE-2026-83938 Azure Kubernetes Configuration Service Elevation of Privilege VulnerabilityMicrosoft Security Update Guide, 22 Oct 2026
Description
Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.
Text from CVE List
Affected versions 1
- Azure Kubernetes Configuration Serviceaffected: -CVE List