AKS vulnerability remediation when nodes are already on latest node image

Waqas Hussain 131 Reputation points
2026-08-07T07:36:49.84+00:00

We are reviewing critical vulnerabilities reported by Wiz against our Azure Kubernetes Service (AKS) node pools. A significant number of findings relate to the node OS/kernel and AKS-managed components. For example, Wiz currently reports approximately 1,500+ critical findings against AKS node components. We have confirmed that the affected node pools are already running the latest AKS node image available to them.

We would appreciate clarification on the supported remediation approach and ownership for these findings:

  1. If an AKS node pool is already running the latest available AKS node image, but a vulnerability scanner reports an OS/package CVE with a vendor fix available, is there any Microsoft-supported method for customers to patch that component directly on the AKS worker nodes?
  2. Should customers instead wait for Microsoft/AKS to incorporate the fix into a subsequent AKS node image?
  3. Is manually applying OS/package updates directly on AKS worker nodes supported, for example using apt, dnf, Windows Update, or other package-management mechanisms? Could doing this create configuration drift or result in the changes being lost when nodes are reimaged, replaced, scaled, or upgraded?
  4. Since AKS node pools are backed by Azure Virtual Machine Scale Sets, can customers use VMSS-level patching or update mechanisms against AKS worker nodes, such as:
    • Azure Update Manager
    • Automatic VM Guest Patching
    • VMSS OS image upgrades
    • Windows Update or Linux package updates

Any guidance on the recommended vulnerability-management and OS patching process for AKS would be greatly appreciated.

Azure Kubernetes Service
Azure Kubernetes Service

An Azure service that provides serverless Kubernetes, an integrated continuous integration and continuous delivery experience, and enterprise-grade security and governance.

0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-08-07T07:37:26.5666667+00:00

    For AKS-managed OS and kernel vulnerabilities on worker nodes, the supported remediation path is to keep the node image current and apply AKS node image upgrades when Microsoft publishes a patched image.

    Supported guidance from the available documentation:

    1. AKS patches CVEs through node image and VHD updates
      • AKS patches CVEs that have a vendor fix every week.
      • Fixed container images are cached into the next corresponding VHD build.
      • OS-based vulnerability fixes are delivered through node image VHD updates, with weekly node image releases.
      • If nodes are running the updated VHD, they should not be running container image CVEs with a vendor fix that is over 30 days old.
    2. If the node pool is already on the latest AKS node image, the documented action is to wait for the next AKS-published fix when the issue is upstream or not yet incorporated
      • For Ubuntu 22.04 kernel findings, AKS states that some findings persist until Canonical publishes a fix.
      • In those cases, no node image upgrade or version migration clears the finding until the upstream fix is released.
      • AKS also states it automatically incorporates Canonical kernel fixes into new node images as soon as they are published upstream.
    3. The recommended customer remediation workflow is node image upgrade or Kubernetes upgrade, not direct in-place OS patching of AKS nodes
      • In Microsoft Defender for Cloud, the remediation options for Kubernetes node vulnerabilities are Update image to apply the latest patched node pool VM image, or Upgrade Kubernetes to move to a newer Kubernetes version.
      • AKS documentation recommends keeping node images current and enabling automatic upgrades.
      • AKS Automatic further reduces manual patch management by using managed system node pools and automatic cluster upgrade channels.
    4. Direct package patching on AKS worker nodes is not documented here as a supported remediation method
      • The available documentation describes AKS-managed delivery of security fixes through weekly node image/VHD releases.
      • It also notes that security updates come with weekly node image releases by default, and unattended upgrades are disabled unless switched to unmanaged, which is not recommended.
      • Because AKS nodes are reimaged and replaced through normal cluster operations, any manual package changes would not be the documented remediation path and would be at risk of being lost when nodes are recreated.
    5. VMSS-level patching mechanisms are not the documented remediation path in the provided AKS guidance
      • The available AKS guidance points to updating the AKS node image or upgrading Kubernetes.
      • No support statement is provided here for using Azure Update Manager, Automatic VM Guest Patching, VMSS OS image upgrades, or direct Windows/Linux package update tooling against AKS worker nodes as the recommended patching model.
    6. For scanner findings, validate whether the node is actually affected before treating every finding as actionable
      • AKS notes that vulnerability classifications can differ from other sources because AKS considers configuration and security hardening.
      • For Ubuntu kernel CVEs, scanner results may map to the generic linux package even though AKS nodes run linux-azure.
      • The documented validation step is to check the exact installed linux-azure kernel version in the Ubuntu CVE Tracker to determine whether that specific kernel is Fixed, Vulnerable, Vulnerable work in progress, or Vulnerable fix deferred.
    7. Exception: when AKS publishes a specific self-service mitigation, apply that mitigation
      • In the Copy Fail bulletin, AKS states that existing nodes created before the hotfix VHD are not protected and strongly recommends applying the published self-service mitigation until patched VHD-based nodes are in use.
      • This is a bulletin-specific exception, not a general OS patching model.

    In short:

    • Supported default approach: wait for AKS to publish the patched node image, then upgrade node images.
    • Recommended operational action: keep node images current, use automatic upgrades where possible, and use Defender for Cloud’s Update image or Upgrade Kubernetes actions.
    • Not established as supported in the provided documentation: customer-managed in-place patching of AKS worker nodes or VMSS-native patch orchestration as the standard remediation method for AKS node vulnerabilities.
    • Important validation step: confirm whether reported kernel CVEs actually apply to the installed linux-azure version before treating scanner output as a true exposure.
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.