CVE-2026-31431: Copy Fail vulnerability enables Linux root privilege escalation across cloud environments

2026-05-02T08:52:26Z•84c2a6ab40d75b5d12a6ec73a3111a8aedf87d07e56a46d6386e4ab5a01b4948

CVE-2026-31431Copy FailKubernetesLinuxclouddetectionexploit-in-the-wildlocal privilege escalationmitigationpatchingprivilege escalation

Open source link →

What happened

CVE-2026-31431 (“Copy Fail”) is a high-severity Linux vulnerability that enables local root privilege escalation across cloud environments and Kubernetes workloads. Microsoft reports a working exploit in the wild and urges organizations to quickly detect, mitigate, and reduce risk. Immediate actions include applying vendor patches or mitigations, auditing affected kernel/OS versions and container images, and monitoring for signs of exploitation in cloud and cluster telemetry.

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID: microsoft_security_blog
Record identifier: 84c2a6ab40d75b5d12a6ec73a3111a8aedf87d07e56a46d6386e4ab5a01b4948
Enrichment time: 2026-05-02T08:52:26Z
AI-assisted enrichment: Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.

← Back to published records