Loading story…
Palo Alto Networks Unit 42 disclosed FabricScape, an attack technique tied to CVE-2022-30137 that allows an attacker to escape a Microsoft Service Fabric environment and compromise the broader cluster. The issue affects the boundary between hosted workloads and the underlying Service Fabric infrastructure, enabling a malicious actor with code execution in a service container or application context to move beyond the intended isolation model.
Successful exploitation can let an attacker take over cluster resources, interfere with other applications, and gain high-privilege control over the Service Fabric environment. The finding highlights a serious risk for organizations using Service Fabric to host multi-tenant or business-critical services, because a breach of one workload can be leveraged into compromise of the entire cluster if the vulnerability is not remediated.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Palo Alto Networks Unit 42 published research detailing 'FabricScape,' explaining how CVE-2022-30137 could be used to escape Service Fabric and take over a cluster. The publication provided technical details that expanded public understanding of the vulnerability's impact.
Microsoft addressed CVE-2022-30137, a vulnerability in Azure Service Fabric that could allow an attacker to escape a containerized application and gain control of the Service Fabric cluster. The Unit 42 report discusses the issue as a disclosed and patched flaw.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities in the Kubernetes-native serverless platform **Fission** were disclosed, both allowing low-privileged tenants to inject unsafe `PodSpec` fields that can lead to **node escape** and broader **cluster compromise**. **CVE-2026-50563** affects the Container Executor path, where `Function.spec.podspec` could be merged into an executor-generated pod definition before a Deployment is created, while **CVE-2026-50545** affects the Environment CRD path through insufficient validation of `Environment.spec.runtime.podSpec` and `spec.builder.podSpec`. Both issues carry a CVSS v3.1 rating of `AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`, reflecting low attack complexity and high impact to confidentiality, integrity, and availability. The flaws affect **Fission versions prior to 1.24.0**, and the project has released fixes in **version 1.24.0** alongside related GitHub advisories and pull requests. The disclosures indicate that unsafe passthrough and merge behavior in pod creation logic could let a tenant influence generated pods in ways that break isolation boundaries, turning serverless function deployment features into a path for host-level access and potential **cluster takeover**. Separately, a malicious Rust crate, **`onering` 1.4.1**, was also reported on the same day after being uploaded to crates.io with code designed to exfiltrate project metadata and source code before being removed roughly six hours later, though no evidence of actual use was reported.
Jun 29, 2026
Palo Alto Networks Unit 42 disclosed a dual privilege-escalation chain in **Google Kubernetes Engine (GKE)** that could let an attacker with limited access gain broader control inside Kubernetes environments. The attack path combined weaknesses in monitoring-related configuration and service mesh privileges, allowing unauthorized access to cluster resources and creating a route from a constrained foothold to elevated permissions. The reported chain involved **Fluent Bit** and **Anthos Service Mesh** components, showing how overly permissive configurations and inherited privileges in managed Kubernetes deployments can be linked together for escalation. The findings highlight the risk of misconfigured observability and mesh tooling in cloud-native environments, where service accounts, cluster roles, and add-on integrations can expand an attacker’s reach beyond the initial compromise if not tightly scoped.
Jul 12, 2026
ServiceNow disclosed and remediated **CVE-2026-6875**, a critical sandbox escape in its AI Platform that can allow **unauthenticated remote code execution** in certain circumstances. The vulnerability affects both hosted and self-hosted ServiceNow environments, carries a **CVSS 4.0 score of 9.5**, and was published in advisory `KB3137947`. ServiceNow said it has already deployed security updates to hosted instances and issued patched family releases and updates for self-hosted customers and partners. The company said it is **not currently aware of active exploitation**, but warned that successful compromise could let attackers execute code within the ServiceNow platform, disrupt workflows, access sensitive data, modify records, and enable follow-on malicious activity. To reduce near-term exploit risk, ServiceNow limited public technical details while directing customers to promptly apply the relevant updates or upgrade to patched releases, including fixes for the **Brazil, Australia, Zurich, and Yokohama** release families.
Jul 21, 2026