Microsoft Azure Stack Edge vulnerabilities

4 CVEs affecting Microsoft Azure Stack Edge, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-47643, published 2026-06-09.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-37968, published 2022-10-11. Critical severity, CVSS 10.0. EPSS: 3% chance of exploitation in the next 30 days. Microsoft has identified a vulnerability affecting the cluster connect feature of Azure Arc-enabled Kubernetes clusters. This vulnerability could allow an unauthenticated user to elevate their…
• CVE-2023-21703, published 2023-02-14. High severity, CVSS 7.2. EPSS: 1.5% chance of exploitation in the next 30 days. Azure Data Box Gateway Remote Code Execution Vulnerability
• CVE-2026-47643, published 2026-06-09. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. External control of file name or path in Azure Stack Edge allows an unauthorized attacker to execute code over a network.
• CVE-2026-41098, published 2026-06-09. High severity, CVSS 8.4. EPSS: 0.8% chance of exploitation in the next 30 days. Improper neutralization of input during web page generation ('cross-site scripting') in Azure Stack Edge allows an authorized attacker to perform spoofing over a network.