Microsoft Azure Kubernetes Service — known CVE vulnerabilities

Every CVE whose affected-product data names Microsoft Azure Kubernetes Service, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (9)

• CVE-2026-33105 — CVSS 10.0 (critical): Improper authorization in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network.
• CVE-2024-21403 — CVSS 9.0 (critical): Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability
• CVE-2024-21376 — CVSS 9.0 (critical): Microsoft Azure Kubernetes Service Confidential Container Remote Code Execution Vulnerability
• CVE-2026-32193 — CVSS 8.8 (high): Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Azure Kubernetes Service allows an authorized…
• CVE-2023-44487 — CVSS 7.5 (high) — actively exploited: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly…
• CVE-2023-29332 — CVSS 7.5 (high): Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
• CVE-2021-27075 — CVSS 6.8 (medium): Azure Virtual Machine Information Disclosure Vulnerability
• CVE-2021-24109 — CVSS 6.8 (medium): Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
• CVE-2021-1677 — CVSS 5.5 (medium): Azure Active Directory Pod Identity Spoofing Vulnerability