CVE-2026-99999 (PwnEscape) — Is Azure App Service on Linux affected and has Microsoft completed remediation?

Hello Microsoft Azure Team,

We are assessing the potential impact of CVE-2026-99999 (PwnEscape) on applications hosted in Azure App Service on Linux.

Our environment uses:

• Azure App Service on Linux

Free F1 shared hosting plan

Central US region

Built-in Java and Node.js runtimes

Code-based deployment (no custom Docker images)

Development/testing workloads

We have reviewed Azure Service Health, including active security advisories and three months of historical events, and found no notifications related to this vulnerability.

We also found the Microsoft Security Response Center advisory for CVE-2026-99999, including the Azure Linux 3.0 kernel update.

Could a Microsoft engineer please clarify:

Is Azure App Service on Linux potentially affected by CVE-2026-99999?

Does the published Azure Linux 3.0 security update apply to the underlying infrastructure used by Azure App Service?

Has Microsoft completed any necessary mitigation or patching for Azure App Service in the Central US region?

Is any customer-side action required, such as restarting or redeploying applications?

Is there an official Azure App Service security advisory or documentation confirming the service's mitigation status?

We understand that Azure App Service is a managed platform where Microsoft handles underlying operating system patching.

We are seeking confirmation of the service-level security status to document our risk assessment.

Thank you.Hello Microsoft Azure Team,

We are assessing the potential impact of CVE-2026-99999 (PwnEscape) on applications hosted in Azure App Service on Linux.

Our environment uses:

Azure App Service on Linux

Free F1 shared hosting plan

Central US region

Built-in Java and Node.js runtimes

Code-based deployment (no custom Docker images)

Development/testing workloads

We have reviewed Azure Service Health, including active security advisories and three months of historical events, and found no notifications related to this vulnerability.

We also found the Microsoft Security Response Center advisory for CVE-2026-99999, including the Azure Linux 3.0 kernel update.

Could a Microsoft engineer please clarify:

Is Azure App Service on Linux potentially affected by CVE-2026-99999?

Does the published Azure Linux 3.0 security update apply to the underlying infrastructure used by Azure App Service?

Has Microsoft completed any necessary mitigation or patching for Azure App Service in the Central US region?

Is any customer-side action required, such as restarting or redeploying applications?

Is there an official Azure App Service security advisory or documentation confirming the service's mitigation status?

We understand that Azure App Service is a managed platform where Microsoft handles underlying operating system patching.

We are seeking confirmation of the service-level security status to document our risk assessment.

Thank you.