CVE-2026-56163
A critical security flaw in Microsoft Azure Kubernetes Service (AKS) lets an attacker gain elevated privileges without authentication. The vulnerability can be exploited over the network and requires no user interaction. It poses a severe risk to any AKS deployment that has not been patched.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Microsoft Azure Kubernetes Service (AKS) – all versions that have not applied a patch for this authentication bypass.
Real-world impact
An attacker who can reach the AKS network can use the flaw to gain administrative control, potentially accessing or modifying all workloads, data, and infrastructure managed by the cluster.
Why this severity
The CVSS score of 10 reflects that the flaw is network‑accessible, requires no authentication or user interaction, and gives an attacker full control over the affected system, meeting the criteria for a critical vulnerability.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 24, 2026 · 8d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 29, 2026 · 3d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- msrc.microsoft.com/update-guide/vulnerability/…vendor advisory