CVE-2026-32193

Published Jun 9, 2026

Last updated a month ago

CVSS high 8.8

Overview

Description: Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Azure Kubernetes Service allows an authorized attacker to execute code locally.
Source: secure@microsoft.com
NVD status: Analyzed
Products: azure_kubernetes_service

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8.8
Impact score: 6
Exploitability score: 2
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Severity: HIGH

Weaknesses

secure@microsoft.com: CWE-22

Hype score: Not currently trending

CVE-2026-32193: path traversal in AKS lets an authenticated attacker execute code on the node. No patch yet, no affected versions, and the CVE year is 2026 (probably embargo or typo). Here's what to check Thursday.
@disismohi
11 Jun 2026
53 Impressions
0 Retweets
0 Likes
0 Bookmarks
1 Reply
0 Quotes

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:microsoft:azure_kubernetes_service:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "AA0B155F-C446-4639-8567-D821842EC1F8",
            "versionEndExcluding": "2026-02-13.5",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Weaknesses

Social media

Configurations

Related CVEs

References