CVE-2026-33105
Published: 03 April 2026
Summary
CVE-2026-33105 is a critical-severity Improper Authorization (CWE-285) vulnerability in Microsoft Azure Kubernetes Service. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 49.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-33105 is an improper authorization vulnerability in Microsoft Azure Kubernetes Service, mapped to CWEs-285 (Improper Authorization) and CWE-863 (Incorrect Authorization). Published on 2026-04-03, it enables an unauthorized attacker to elevate privileges over a network and carries a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low attack complexity, lack of prerequisites, and high impacts across confidentiality, integrity, and availability with scope change.
The vulnerability can be exploited by any unauthorized attacker with network access to the affected Azure Kubernetes Service instance, requiring no prior privileges or user interaction. Successful exploitation allows privilege escalation, potentially granting the attacker high-level control over the cluster, including unauthorized access to resources, data exfiltration, modification, or disruption.
Mitigation details are available in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33105.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-18562
Vulnerability details
Improper authorization in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE describes unauthenticated network exploitation of public-facing AKS (T1190) that directly results in privilege escalation to cluster admin control (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for access to system resources, directly addressing the improper authorization in Azure Kubernetes Service that enables network-based privilege escalation.
Employs least privilege to limit unauthorized elevation of privileges as exploited by attackers via CVE-2026-33105 in Microsoft Azure Kubernetes Service.
Requires timely identification, reporting, and correction of the specific improper authorization flaw in Azure Kubernetes Service documented in CVE-2026-33105.