CVE-2026-83938
Microsoft — Azure Kubernetes Configuration Service Elevation of Privilege Vulnerability
Microsoft · CWE-306
EVRS 13 of 100 Elevated
Scheduled Maintenance
Rank 1,696 of 2,963 tracked
Why it scores 13
Evidence available: 5 of 8 signalsAn EPSS probability of 0.007, and CVSS base score 10.0.
- CISA KEVDid not apply
- RansomwareNo data
- Vendor exploitationDid not apply
- EPSSApplied
- Microsoft Exploitability IndexNo data
- Pre-patch disclosureDid not apply
- KEV recencyNo data
- CVSSApplied
The band answers “how soon”, not “how bad”. No data for: Ransomware, Microsoft Exploitability Index, KEV recency. Why some signals show no data
Fix
No fixed version identified yetAffected versions
Not identified by the connected sources
Remediation
Apply the vendor patch or guidance: https://github.com/advisories/GHSA-2vxx-fgvw-2r33 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83938
Evidence
Each value with its source| Measure | Value | Source |
|---|---|---|
| CVSS base scoreHow severe the flaw is in itself. It does not say how likely an attack is. | 10.0 | NVD |
| FIRST EPSSFIRST's estimate of the chance this is exploited in the next 30 days, and how that ranks against all CVEs. | 0.007 (53.1st pctl) | FIRST EPSS |
| Actively exploitedWhether a source of record has confirmed attacks using it in the wild. | Not confirmed | Patch Tuesday |
| Public exploit moduleA module existing is not the same as active exploitation. | None known | Metasploit |
| EUVD cross-referenceENISA's record: CVSS 10.0 (v3.1), assigned by microsoft. | Listed | ENISA EUVD |
Description
NVDMissing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.