Critical CVE-2026-56163 Hits Azure Kubernetes Service

Microsoft has disclosed a critical vulnerability in Azure Kubernetes Service that carries a CVSS score of 10.0.

A missing authentication flaw enables privilege escalation. The vulnerability, tracked as CVE-2026-56163, stems from missing authentication for a critical function. An unauthorized attacker can exploit it over a network to elevate privileges.

The issue affects Azure Kubernetes Service with no specific version range listed beyond the product being marked as affected.

The vulnerability scores maximum severity under CVSS 3.1. Microsoft Corporation supplied the CVSS 3.1 vector string of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, resulting in a base score of 10.0 critical. This indicates network attack complexity is low, privileges are not required, user interaction is not needed, and the scope is changed with high impacts to confidentiality, integrity, and availability.

The National Vulnerability Database has not yet provided its own CVSS 4.0 or 2.0 assessment. The record was received exclusively as a hosted service.

The CVE record was received from Microsoft Corporation on July 24, 2026. The record was added to the CVE List on July 24, 2026, at 11:18:33 AM. It references the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56163 for further details on solutions and mitigations.

The weakness is classified under CWE-306. The Common Weakness Enumeration entry is Missing Authentication for Critical Function, as provided by Microsoft Corporation. The affected configuration lists Microsoft as the vendor and Azure Kubernetes Service as the product with affected status.