Microsoft's Security Update Guide published it on 22 October 2026 at 07:00 US Pacific time (14:00 UTC; 10:00 pm Perth) CVE-2026-83938, 'Azure Kubernetes Configuration Service Elevation of Privilege Vulnerability': missing authentication for a critical function (CWE-306) in Azure Kubernetes Configuration Service allows an unauthorised attacker to elevate privileges over a network. Microsoft rates it Critical with a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

Microsoft's FAQ says the vulnerability has already been fully mitigated by Microsoft, there is no action for users of the service to take, and the CVE is published to provide further transparency.

Microsoft lists it as not publicly disclosed and not exploited. It was one of six Microsoft cloud-service CVEs published that day; the others are on their own desk cards. Primary: Microsoft Security Response Center; CVE record.