Azure Kubernetes Service EUVD-2026-35504

Exploitation requires the attacker to already hold low-level authorized access (PR:L) on the local system - in AKS terms, this typically means code execution inside a pod, a workload identity, or shell access on a node - and to be able to reach the vulnerable AKS component that processes attacker-controlled filesystem paths. The attack vector is local (AV:L), so it cannot be triggered directly from the public internet without first obtaining a foothold in the cluster, and no user interaction is required (UI:N). Limiting factors include the need for valid in-cluster credentials or container execution, the AV:L constraint that rules out direct internet exploitation, and the fact that AKS-managed components may already be patched on clusters using auto-upgrade channels; the description does not name a specific feature flag or non-default configuration, so the condition should be treated as 'any AKS cluster running an unpatched version where an attacker can obtain low-privileged local execution'.

The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) indicates that exploitation requires local access with low privileges but no user interaction, and crucially carries a Scope:Changed designation - meaning a successful attack crosses a security boundary (e.g., container-to-host or tenant-to-control-plane), justifying the elevated 8.8 score despite the local attack vector. EPSS data was not provided in the input, KEV status is not listed, and no POC has been published in the available references, so this should currently be treated as a high-impact but not-yet-weaponized issue. The single MSRC reference and the secure@microsoft.com reporter strongly suggest vendor-coordinated disclosure with a fix already shipped through Azure's managed service pipeline; however, because AKS is a hosted service, much of the remediation may be applied transparently by Microsoft, which limits real-world attacker windows compared to on-premises Kubernetes distributions.

An attacker who has obtained low-privileged local access on an AKS node or inside a tenant pod - for example, via a compromised application container or stolen workload credentials - sends a crafted request containing traversal sequences to a vulnerable AKS component that handles file paths, causing it to read, write, or execute files outside the intended sandbox. Because the CVSS scope is Changed, this allows the attacker to break out of the container or namespace boundary and execute code in the context of the host node or another tenant, achieving full compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, so this scenario is constructed from the CVSS vector and CWE-22 mechanics rather than an observed proof-of-concept.