This vulnerability (CVE-2026-33105) involves improper authorization in Microsoft Azure Kubernetes Service, enabling an attacker without privileges to escalate their permissions remotely. The CVSS 3.1 base score is 10.0, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, and high impact on confidentiality, integrity, and availability. The vendor has issued an official fix and manages remediation for this cloud-hosted service.

Successful exploitation allows an unauthorized attacker to gain elevated privileges within Azure Kubernetes Service, potentially compromising the confidentiality, integrity, and availability of the service and hosted workloads. This could lead to full control over affected resources in the cloud environment.

Microsoft has released an official fix for this vulnerability and manages remediation for Azure Kubernetes Service as a cloud-hosted service. Users should ensure their Azure Kubernetes Service instances are updated according to the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33105. No additional user action is required beyond applying the official fix.