Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2022-37968

32
FAUCET Score

CVE-2022-37968 is a critical privilege escalation vulnerability affecting the cluster connect feature of Azure Arc-enabled Kubernetes clusters and Azure Stack Edge devices. With a CVSS score of 10.0, an unauthenticated attacker can remotely gain administrative control over affected Kubernetes clusters with low attack complexity. While there is no known active exploitation or public exploit code available, the vulnerability has garnered significant community discussion and media coverage, indicating high awareness.

Impacted Technologies

VendorProductVersion(s)CPE
1.5.8CPE matchmatch criteria
cpe:2.3:a:microsoft:azure_arc-enabled_kubernetes:1.5.8:*:*:*:*:*:*:*
1.6.19CPE matchmatch criteria
cpe:2.3:a:microsoft:azure_arc-enabled_kubernetes:1.6.19:*:*:*:*:*:*:*
1.7.18CPE matchmatch criteria
cpe:2.3:a:microsoft:azure_arc-enabled_kubernetes:1.7.18:*:*:*:*:*:*:*
1.8.11CPE matchmatch criteria
cpe:2.3:a:microsoft:azure_arc-enabled_kubernetes:1.8.11:*:*:*:*:*:*:*
Range not provided by sourceCPE matchmatch criteria
cpe:2.3:a:microsoft:azure_stack_edge:-:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

10.0CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
6.0
CvssVersion
3.1

Exploit Intelligence

EPSS Score
2.66%
Probability of exploitation in next 30 days
EPSS Percentile
84.1%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0266 is in the 75th percentile among its peer group of 36,862 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (6)

microsoftpatch availablevia nvd_reference
View patch
microsoftpatch availablevia msrc
Product: Azure Arc-enabled Kubernetes cluster 1.8.11Fixed in: 1.8.11
View patch
microsoftpatch availablevia msrc
Product: Azure Arc-enabled Kubernetes cluster 1.7.18Fixed in: 1.7.18
View patch
microsoftpatch availablevia msrc
Product: Azure Arc-enabled Kubernetes cluster 1.5.8Fixed in: 1.5.8
View patch
microsoftpatch availablevia msrc
Product: Azure Arc-enabled Kubernetes cluster 1.6.19Fixed in: 1.6.19
View patch
microsoftpatch availablevia msrc
Product: Azure Stack EdgeFixed in: 2.2.2088.5593
View patch

Vendor Advisories (1)

microsoft2022-Oct/CVE-2022-37968Critical

Azure Arc-enabled Kubernetes cluster Connect Elevation of Privilege Vulnerability

Oct 11, 2022

References

portal.msrc.microsoft.com / en-US/security-guidance/advisory/CVE-2022-37968
PatchVendor Advisory
msrc.microsoft.com / update-guide/vulnerability/CVE-2022-37968