Microsoft has disclosed CVE-2026-83938, a CVSS 10.0 missing-authentication vulnerability in Azure Kubernetes Configuration Service that lets an unauthorized attacker elevate privileges over a network.
What Is It
CVE-2026-83938 is a missing-authentication-for-critical-function weakness (CWE-306) in Microsoft's Azure Kubernetes Configuration Service. According to the NVD record, an unauthorized attacker can exploit the flaw over a network to elevate privileges.
Microsoft ([email protected]) is the CVE source. NVD published the record on 2026-10-22, and its status is currently "Received," which means NVD has not yet completed its own analysis.
Why It Matters
Microsoft rates the vulnerability 10.0 (CRITICAL), the highest CVSS 3.1 score possible:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Confidentiality / Integrity / Availability Impact: High / High / High
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Put simply, a remote attacker with no credentials and no help from a user could exploit this flaw. Because the scope is "Changed," the impact can reach past the vulnerable component itself, and confidentiality, integrity and availability are all rated High. The exploitability subscore is 3.9 and the impact subscore is 6.0.
Exploitation status: No CISA KEV entry was supplied for this CVE, so KEV does not currently confirm active exploitation. The source material includes no other exploitation reports.
What's Vulnerable
- Vendor: Microsoft
- Product: Azure Kubernetes Configuration Service
- Versions: Marked "affected." The record lists no specific version ("-").
Microsoft tagged the CVE exclusively-hosted-service, meaning the affected product is a service hosted by Microsoft rather than software that customers install. NVD lists no affected CPEs.
Patch Status
The supplied records don't describe a patch, fix version or required customer action. There is also no CISA KEV remediation deadline, because no KEV entry exists. Microsoft's Security Update Guide entry, linked below, is the authoritative source for remediation details and any steps customers need to take. Azure customers using Kubernetes configuration features should check that advisory and confirm what, if anything, they need to do.