Microsoft Azure Kubernetes Service vulnerabilities

11 CVEs affecting Microsoft Azure Kubernetes Service, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-50516, published 2026-08-11.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-44487: HTTP/2 Rapid Reset Attack Vulnerability, published 2023-10-10. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2023-10-10. EPSS: 100% chance of exploitation in the next 30 days. The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
• CVE-2023-29332, published 2023-09-12. Critical severity, CVSS 9.8. EPSS: 2.7% chance of exploitation in the next 30 days. Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
• CVE-2021-24109, published 2021-02-25. Medium severity, CVSS 6.8. EPSS: 2.2% chance of exploitation in the next 30 days. Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
• CVE-2021-27075, published 2021-03-11. Medium severity, CVSS 6.8. EPSS: 1.4% chance of exploitation in the next 30 days. Azure Virtual Machine Information Disclosure Vulnerability
• CVE-2024-21403, published 2024-02-13. Critical severity, CVSS 9.0. EPSS: 1.3% chance of exploitation in the next 30 days. Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability
• CVE-2024-21376, published 2024-02-13. Critical severity, CVSS 9.0. EPSS: 1.2% chance of exploitation in the next 30 days. Microsoft Azure Kubernetes Service Confidential Container Remote Code Execution Vulnerability
• CVE-2021-1677, published 2021-01-12. Medium severity, CVSS 5.5. EPSS: 1.2% chance of exploitation in the next 30 days. Azure Active Directory Pod Identity Spoofing Vulnerability
• CVE-2026-56163, published 2026-07-24. Critical severity, CVSS 10.0. EPSS: 0.9% chance of exploitation in the next 30 days. Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-33105, published 2026-04-03. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Improper authorization in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-50516, published 2026-08-11. Critical severity, CVSS 9.4. EPSS: 0.8% chance of exploitation in the next 30 days. Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network.

Latest

• CVE-2026-32193, published 2026-06-09. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Azure Kubernetes Service allows an authorized attacker to execute code locally.