Three perfect 10s: Azure App Service, AKS, and Data Quality all wide open

Azure Kubernetes Service is missing authentication on a critical function, letting an unauthenticated attacker escalate privileges over the network. CVSS 10.0, no user interaction required. If you run AKS clusters, an attacker could gain elevated control without ever logging in.

Affected estate

Anyone running Azure Kubernetes Service (AKS) clusters

How to check

In the Azure Portal, go to Kubernetes services and check cluster version and security advisories. Run 'az aks show' to confirm the current version.

Included because

unauthenticated; network-exploitable; CVSS 10.0; widely used cloud platform

Action

Upgrade AKS clusters to the patched version listed in Microsoft's advisory.

Why it matters

Missing authentication on a critical function means an attacker can escalate privileges in your Kubernetes environment with zero credentials.

Source

Microsoft Security Advisory

A server-side request forgery (SSRF) bug in Microsoft Data Quality lets an unauthenticated attacker escalate privileges over the network. CVSS 10.0. An attacker can trick the server into making requests on their behalf, potentially reaching internal resources and gaining elevated access.

Affected estate

Anyone using Microsoft Data Quality services

How to check

Check Microsoft's security advisory for affected versions and compare against your deployment. Review the Azure Portal for service update notifications.

Included because

unauthenticated; network-exploitable; CVSS 10.0; SSRF to privilege escalation

Action

Apply the security update from Microsoft's advisory.

Why it matters

SSRF with privilege escalation and no authentication means an attacker can pivot through your service to reach internal systems or gain elevated access.

Source

Microsoft Security Advisory

A use-after-free bug in the Linux kernel's traffic control subsystem (cls_api). When the RED qdisc uses qevents with act_ct and out-of-order fragments arrive, the kernel keeps using an skb it no longer owns. This can crash the system or let an attacker execute code. Exploitation requires a specific setup: RED qdisc with qevent early_drop wired to a block using act_ct with defrag, plus fragmented traffic. That narrows the blast radius, but if you run this config, it's a CVSS 9.8.

Affected estate

Linux sysadmins running kernels with RED qdisc qevents and act_ct (traffic control with connection tracking and defragmentation)

How to check

Run 'tc qdisc show' and look for RED qdiscs with qevent configurations. Check 'tc filter show block <N>' for act_ct actions. Check your running kernel version with 'uname -r'.

Included because

CVSS 9.8; use-after-free in kernel network path; common platform

Action

Update the kernel to the latest patched version from your distro. If immediate reboot isn't possible, remove the qevent/act_ct filter chain.

Why it matters

A use-after-free in the network stack can cause kernel crashes or let an attacker execute arbitrary code, but exploitation requires a specific RED + act_ct + fragmented traffic setup.

Source

Linux kernel mailing list / NVD

An authorization bug in the Azure Portal lets an unauthenticated attacker read data they shouldn't have access to, over the network. CVSS 9.3. This is an information disclosure issue, not code execution, but the severity rating and the lack of any authentication requirement make it serious.

Affected estate

Anyone with resources managed through the Azure Portal

How to check

Review Microsoft's security advisory for this CVE. Check Azure Portal notifications and Service Health for update status.

Included because

unauthenticated; network-exploitable; CVSS 9.3; widely used cloud management portal

Action

Confirm the platform-side fix is deployed by Microsoft. Audit recent access logs for anomalous information disclosure.

Why it matters

Unauthenticated information disclosure at CVSS 9.3 means an attacker could read sensitive data from your Azure environment without any credentials.

Source

Microsoft Security Advisory