Three CVSS 10.0 Azure bugs in one day, plus AKS and App Service wide open

A missing authentication check in Azure Kubernetes Service lets an unauthenticated attacker escalate privileges over the network. CVSS 10.0. If your AKS clusters are reachable, an attacker could gain elevated access without any credentials at all.

Affected estate

Anyone running Azure Kubernetes Service clusters

How to check

Run 'az aks show --resource-group <rg> --name <cluster> --query kubernetesVersion' and compare against the patched version listed in Microsoft's advisory.

Included because

unauthenticated; internet-facing; CVSS 10.0; widely used managed Kubernetes service

Action

Upgrade the AKS control plane and node pools to the patched version. Restrict API server access to trusted networks if you haven't already.

Why it matters

Unauthenticated privilege escalation in your Kubernetes control plane could let an attacker own your entire cluster and every workload running on it.

Source

Microsoft advisory

An SSRF (server-side request forgery) bug in Microsoft Data Quality lets an unauthenticated attacker escalate privileges over the network. CVSS 10.0. An attacker can trick the service into making internal requests on their behalf, potentially reaching resources that should never be exposed externally.

Affected estate

Anyone using Microsoft Data Quality services

How to check

Review your Azure resource inventory for any Data Quality deployments. Check the Azure Service Health blade or Microsoft Security Response Center for the specific advisory.

Included because

unauthenticated; SSRF; CVSS 10.0; privilege escalation

Action

Apply the patch or platform update when available. Lock down network access to trusted IP ranges as an interim control.

Why it matters

SSRF with privilege escalation at CVSS 10.0 means an attacker can pivot from an external request to internal resources, potentially accessing sensitive data or other services in your environment.

Source

Microsoft advisory

An authorization bypass in the Azure Portal lets an unauthenticated attacker read information they shouldn't have access to. CVSS 9.3. This is a data disclosure bug, not code execution, but the severity score and the lack of authentication required make it serious.

Affected estate

Anyone with Azure subscriptions managed through the Azure Portal

How to check

Check the Microsoft Security Response Center and Azure Service Health for advisories referencing CVE-2026-62835. Review Azure AD sign-in and audit logs for unusual activity.

Included because

unauthenticated; internet-facing; CVSS 9.3; information disclosure

Action

This is likely a server-side fix Microsoft needs to deploy. Confirm the fix is rolled out via the advisory, and audit your environment for signs of information exposure.

Why it matters

Unauthenticated information disclosure at CVSS 9.3 could expose tenant configuration data, resource metadata, or other sensitive details to anyone on the internet.

Source

Microsoft advisory

A double-free bug in Redis before 8.8.0 lets an authenticated attacker execute remote code by sending a crafted RESTORE payload. The attacker needs to be able to run RESTORE and XGROUP DELCONSUMER commands, which is unusual in production configs but possible if ACLs aren't locked down. This is a regression from an incomplete fix for CVE-2026-25243.

Affected estate

Anyone running self-hosted Redis versions before 8.8.0

How to check

Connect to your Redis instance and run 'INFO server' or 'redis-server --version'. Any version below 8.8.0 is vulnerable.

Included because

authenticated; RCE; common infrastructure component; incomplete prior fix

Action

Upgrade to Redis 8.8.0 or later. As a short-term mitigation, restrict the RESTORE command via ACLs so only trusted clients can use it.

Why it matters

An authenticated attacker who can run RESTORE can get remote code execution on your Redis server, which often has access to sensitive cached data and internal network segments.

Source

Redis project advisory / NVD