CVE-2022-37968

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

Microsoft has identified a vulnerability affecting the cluster connect feature of Azure Arc-enabled Kubernetes clusters. This vulnerability could allow an unauthenticated user to elevate their privileges and potentially gain administrative control over the Kubernetes cluster. Additionally, because Azure Stack Edge allows customers to deploy Kubernetes workloads on their devices via Azure Arc, Azure Stack Edge devices are also vulnerable to this vulnerability.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Oct 11, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-379697.8Windows Common Log File System Driver Elevation of Privilege VulnerabilityCVE-2022-37976.1A vulnerability was found in eolinker apinto-dashboard. It has been rated as problematic. This issue affects some unknown processing of the CVE-2022-379707.8Windows DWM Core Library Elevation of Privilege VulnerabilityCVE-2022-379717.1Microsoft Windows Defender Elevation of Privilege VulnerabilityCVE-2022-379727.5Microsoft Endpoint Configuration Manager Spoofing VulnerabilityCVE-2022-379737.7Windows Local Session Manager (LSM) Denial of Service VulnerabilityCVE-2022-379746.5Windows Mixed Reality Developer Tools Information Disclosure VulnerabilityCVE-2022-379758.8Windows Group Policy Elevation of Privilege VulnerabilityCVE-2022-379768.8Active Directory Certificate Services Elevation of Privilege VulnerabilityCVE-2022-379776.5Local Security Authority Subsystem Service (LSASS) Denial of Service VulnerabilityCVE-2022-379787.5Windows Active Directory Certificate Services Security Feature BypassCVE-2022-379797.8Windows Hyper-V Elevation of Privilege Vulnerability
CVE-2022-37968: Critical severity, CVSS 10.0 | Vulnix