What is the CVSS score of CVE-2026-56160?

CVE-2026-56160 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Azure Red Hat OpenShift are affected by CVE-2026-56160?

Azure Red Hat OpenShift (ARO) customers face a critical privilege escalation vulnerability (CVE-2026-56160, CVSS 9.9) that allows authenticated cluster users with limited permissions to escalate to…. A patch is available.

How to fix or mitigate CVE-2026-56160?

Within 24 hours, complete a full inventory of Azure Red Hat OpenShift clusters and identify all service accounts and human users with cluster access rights, particularly focusing on those with automated or programmatic access. Within 7 days, test the available vendor patch in a non-production ARO environment, coordinate maintenance windows with dependent application teams, and establish a rollback plan. Deploy the patch to all production ARO clusters within 30 days, prioritizing those hosting regulated or sensitive workloads, and verify post-deployment that authentication and authorization controls are enforcing as expected.

Azure Red Hat OpenShift CVE-2026-56160

EUVD-2026-48454 CRITICAL

Improper Authorization (CWE-285)

2026-07-23 microsoft

GHSA-34j8-7jg6-mxhf

Authentication Bypass Microsoft Red Hat Azure Red Hat Openshift Aro

9.9

CVSS 3.1 · NVD

Severity by source

Vendor (microsoft) PRIMARY

CRITICAL

qualitative

NVD

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable authorization bypass usable by an existing low-privileged user (PR:L), low complexity, with scope change to other components and total CIA impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (microsoft).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 07, 2026 - 19:45 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 07, 2026 - 19:37 vuln.today

cvss_changed

CVSS changed

Aug 07, 2026 - 19:37 NVD

9.1 (CRITICAL) 9.9 (CRITICAL)

Analysis Generated

Jul 24, 2026 - 00:47 vuln.today

CVE Published

Jul 23, 2026 - 23:55 cve.org

CRITICAL 9.1

DescriptionNVD

Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate privileges over a network.

AnalysisAI

Privilege escalation in Azure Red Hat OpenShift (ARO) lets an already-authenticated network attacker with limited rights (PR:L) bypass authorization controls (CWE-285) to gain elevated privileges with full confidentiality, integrity, and availability impact. Because the CVSS scope is changed (S:C), the compromise can extend beyond the initially authorized boundary into other components of the managed cluster or platform. There is no public exploit identified at time of analysis and it is not on the CISA KEV list, but the 9.9 CVSS and SSVC 'total' technical impact make it a high-priority patch for any ARO tenant.

Technical ContextAI

Azure Red Hat OpenShift is Microsoft's and Red Hat's jointly-operated managed Kubernetes/OpenShift service, where the control plane and cluster infrastructure are run as a managed offering on Azure. The root cause is CWE-285 (Improper Authorization): an access-control check that fails to correctly verify whether a requesting identity is permitted to perform a privileged action. In a Kubernetes/OpenShift context this class of flaw typically manifests as insufficient RBAC enforcement, missing namespace/tenant isolation checks, or a service endpoint that trusts a lower-privileged caller. The affected CPE is cpe:2.3:a:microsoft:azure_red_hat_openshift_(aro), confirming the managed ARO service itself rather than upstream OpenShift on-premises as the identified product.

RemediationAI

Patch available per vendor advisory - review the Microsoft Security Response Center guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56160 to confirm whether the fix is applied automatically to the managed ARO platform or requires a customer-initiated cluster update; for a managed service the platform-side fix is typically rolled out by Microsoft/Red Hat but customers should verify their cluster is on the current supported build. No exact fixed version string was provided in the input, so do not assume a version number beyond what MSRC states. As compensating controls until confirmed patched, tighten RBAC by auditing and removing unnecessary low-privilege bindings that could serve as the PR:L foothold, restrict network reachability to the cluster API and management endpoints (limit to trusted VNets/private clusters rather than public API server exposure), and enable enhanced audit logging on the OpenShift API to detect anomalous privilege-escalation attempts; the trade-off is that tightening RBAC and network exposure may disrupt legitimate automation or user workflows and should be validated in a non-production tenant first. Cross-reference https://nvd.nist.gov/vuln/detail/CVE-2026-56160 and https://vuldb.com/vuln/382840 for updates.