CVE-2026-83938

Microsoft: missing authentication

Risk score: 90/100
CVSS: 10.0 v3.1
Exploit chance (30 days): 0.7%
Published: 22 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: The Azure Kubernetes Configuration Service has a missing authentication for a critical function, allowing an unauthorized attacker to elevate privileges over a network. An attacker could exploit this to gain high privileges.
Affected: {'vendor': 'microsoft', 'product': 'Azure Kubernetes Configuration Service', 'packages': []}
Fix: Check the linked advisory for a fix
Exploitation: No known exploitation

Why it is Red

CVSS 10.0 critical
Remotely exploitable without logging in
On your watchlist: azure, kubernetes
Named in a government or vendor bulletin

Government and vendor bulletins

CVE-2026-83938 Azure Kubernetes Configuration Service Elevation of Privilege Vulnerability

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83938

Original description

Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.

Last activity 22 Oct 2026. Patch Forecast updates every hour.