Summary
Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Unlikely. Customer action: Required.
Details
How could an attacker exploit this vulnerability?
An attacker who can run an untrusted container configured with hostNetwork could send specially crafted requests to a host‑level service that was not intended for unauthenticated access. This could allow the attacker to break out of the container and gain control of the AKS worker node.
According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?
An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component. In this case, the vulnerable component and the impacted component are different and managed by different security authorities.
Security updates
v0.20260213.5 — https://learn.microsoft.com/en-us/azure/aks/upgrade-node-image
Vulnerabilities 1
-
High 8.8
Azure Kubernetes Service (AKS) Remote Code Execution Vulnerability
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Azure Kubernetes Service allows an authorized attacker to execute code locally.
Revision history
-
#1
Information published.
References
-
CVE-2026-32193 Azure Kubernetes Service (AKS) Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32193
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss