This vulnerability (CVE-2026-33105) in Microsoft Azure Kubernetes Service involves improper authorization, enabling an attacker without privileges to escalate their privileges remotely. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, and high impact on confidentiality, integrity, and availability. The vendor advisory confirms this is a cloud service vulnerability with an official fix available.

An attacker can remotely elevate privileges in Azure Kubernetes Service, potentially gaining full control over the service environment. This compromises confidentiality, integrity, and availability of the affected service, posing a critical risk to workloads running on the platform.

Microsoft manages remediation for this cloud-hosted service and has released an official fix. Users should follow the guidance in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33105 to ensure their Azure Kubernetes Service instances are updated and protected.