Azure Kubernetes Configuration CVE-2026-83938

Per CVSS AV:N/AC:L/PR:N/UI:N there are no special preconditions in terms of authentication or user interaction: a network-positioned attacker can reach a critical function that is missing authentication (CWE-306) and elevate privileges. The exact critical function, protocol, and trigger are not described in the available sources. The principal limiting factor is that Azure Kubernetes Configuration Service is a Microsoft-managed cloud service: network reachability to the vulnerable endpoint and whether Microsoft has already remediated it server-side govern real-world exposure more than any customer-side configuration. No customer-side non-default configuration is stated as required.

Signals mostly align toward high priority. The CVSS 3.1 base is 10.0 with AV:N/AC:L/PR:N/UI:N and a scope change (S:C) plus full C:H/I:H/A:H impact, meaning an unauthenticated network attacker can elevate privileges with impact crossing a security boundary - consistent with CWE-306 (missing authentication for a critical function). The vuln.today decision label is act_now, which is the strongest urgency signal present. However, the temporal metrics temper the raw score: E:U (Exploit Code Maturity: Unproven) and the absence of any POC or exploit reference mean there is no public exploit identified at time of analysis, and the CVE is NOT in CISA KEV, so there is no confirmed active exploitation. No EPSS score was supplied, so exploitation probability cannot be quantified from the input. A key nuance: Azure Kubernetes Configuration Service is a Microsoft-operated cloud service, and the official fix (RL:O, patch available from vendor) is typically applied server-side by Microsoft rather than by customers - so real-world customer exposure may already be reduced regardless of the 10.0 score. Treat as act_now per the decision label, but note the exploitation status is unproven, not weaponized.

An attacker with network reach to the Azure Kubernetes Configuration Service invokes a critical function that fails to enforce authentication, obtaining elevated privileges without credentials or user interaction. Because the CVSS scope is changed (S:C), the gained privileges can affect resources beyond the vulnerable component. No public exploit code or PoC reference was provided, and exploit maturity is rated Unproven.