What is the CVSS score of CVE-2026-32193?

CVE-2026-32193 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Azure Kubernetes Service are affected by CVE-2026-32193?

Microsoft Azure Kubernetes Service (AKS) clusters are vulnerable to a privilege escalation attack (CVE-2026-32193, CVSS 8.8) that could allow attackers to gain elevated system access and compromise…. A patch is available.

How to fix or mitigate CVE-2026-32193?

Within 24 hours: Identify all AKS deployments and audit current pod security policies, node access controls, and service account configurations; establish incident response procedures. Within 7 days: Enforce Azure Pod Security Standards (restricted tier), implement least-privilege RBAC, and deploy container runtime security monitoring across all clusters. Within 30 days: Monitor Microsoft Security Updates for CVE-2026-32193 patch availability and establish rapid deployment procedures for patch application.

Azure Kubernetes Service CVE-2026-32193

EUVD-2026-35504 HIGH

Path Traversal (CWE-22)

2026-06-09 secure@microsoft.com

GHSA-3rwf-9748-8cvv

Path Traversal Kubernetes Microsoft Azure Kubernetes Service

8.8

CVSS 3.1 · Vendor: microsoft

Temporal: 7.7

Severity by source

Vendor (microsoft) PRIMARY

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

7.7 HIGH

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 17:31 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 8.8

DescriptionCVE.org

Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Azure Kubernetes Service allows an authorized attacker to execute code locally.

AnalysisAI

Local privilege escalation and code execution in Microsoft Azure Kubernetes Service (AKS) is possible via a path traversal flaw (CWE-22) that allows an authorized attacker on the local system to break out of restricted directory boundaries and execute code with elevated privileges. The CVSS 3.1 score of 8.8 reflects the scope change (S:C) where exploitation impacts resources beyond the vulnerable component, enabling full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis.

Technical ContextAI

The vulnerability resides in Microsoft Azure Kubernetes Service (AKS), Microsoft's managed Kubernetes orchestration offering that runs containerized workloads on Azure infrastructure. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, commonly called 'path traversal'), where input used to construct a filesystem path is not properly sanitized against sequences like '../' or absolute path references, allowing access to files or directories outside the intended sandbox. In a Kubernetes context, such flaws typically manifest in container runtime components, kubelet APIs, volume mount handling, or admission/CSI drivers - and when chained with the local execution vector observed here, can permit a tenant or node-local actor to escape into host or control-plane resources.

RemediationAI

Patch status per available data: patch available per vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32193, with no exact fix version disclosed in the provided references. Because AKS is a managed service, customers should verify their cluster's Kubernetes version and node image version against the MSRC guidance and trigger a node image upgrade (az aks nodepool upgrade --node-image-only) and, if required, a control-plane upgrade (az aks upgrade) to pull in the fixed components; node auto-upgrade channels (NodeImage or SecurityPatch) will apply this automatically over time but should be accelerated for exposed clusters. As compensating controls until upgrade, restrict who can obtain local execution on nodes by enforcing strict RBAC on 'pods/exec' and 'nodes/proxy', disable hostPath volume mounts via Azure Policy or admission controllers (trade-off: breaks legacy workloads that rely on host filesystem access), enable Pod Security Admission at the 'restricted' level on tenant namespaces (trade-off: rejects privileged or root-running pods), and audit kubelet and container runtime logs for unexpected path traversal patterns.