Azure Compliance ControlsAzure Kubernetes Service
Kubernetes clusters should use a non-vulnerable Kubernetes version
Upgrade your Kubernetes service cluster to a later Kubernetes version to protect against known vulnerabilities. Vulnerability CVE-2019-9946 has been patched in Kubernetes versions 1.11.9+, 1.12.7+, 1.13.5+, and 1.14.0+.
What this control checks
Kubernetes clusters must run a version that is not known to be vulnerable
Framework mappings
The clauses this control is mapped to in each framework.
- SI-2 Flaw Remediation
- SI-2(6) Removal of Previous Versions of Software and Firmware
FedRAMP Moderate Baseline Rev 4
- SI-2 Flaw Remediation
- 3.14.1 Identify, report, and correct system flaws in a timely manner
- 1 IT Governance
- 3.3 Vulnerability Management
- SI.L1-3.14.1 Identify, report, and correct system flaws in a timely manner
- SI-2 Flaw Remediation
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
kubernetes_cluster_upgraded_with_non_vulnerable_version - Powerpipe Control:
azure_compliance.control.kubernetes_cluster_upgraded_with_non_vulnerable_version - Azure Policy Definition:
fb893a29-21bb-418c-a157-e99480ec364c
Last reviewed: 2026-10-13