Search
Find a vulnerability
Search criteria
6 vulnerabilities found for azure-keyvault-secrets by Microsoft
CVE-2026-88132 (GCVE-0-2026-88132)
Vulnerability from nvd – Published: 2026-10-13 19:00 – Updated: 2026-10-14 16:59
VLAI
EPSS
VEX
Title
Azure Key Vault Information Disclosure Vulnerability
Summary
Origin validation error in Azure Key Vault allows an unauthorized attacker to disclose information over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 19:55 UTC
CWE
- CWE-346 - Origin Validation Error
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Azure Key Vault Client SDK |
Affected:
-
|
|
| Microsoft | azure-keyvault-administration |
Affected:
4.7.1 , < 4.8.2
(custom)
|
|
| Microsoft | azure-keyvault-certificates |
Affected:
4.11.2 , < 4.9.2
(custom)
|
|
| Microsoft | azure-keyvault-keys |
Affected:
4.11.2 , < 4.10.2
(custom)
|
|
| Microsoft | azure-keyvault-secrets |
Affected:
4.11.2 , < 4.11.2
(custom)
|
Date Public
2026-10-13 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88132",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T19:55:39.344656Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T20:02:33.461Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Azure Key Vault Client SDK",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "-"
}
]
},
{
"product": "azure-keyvault-administration",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "4.8.2",
"status": "affected",
"version": "4.7.1",
"versionType": "custom"
}
]
},
{
"product": "azure-keyvault-certificates",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "4.9.2",
"status": "affected",
"version": "4.11.2",
"versionType": "custom"
}
]
},
{
"product": "azure-keyvault-keys",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "4.10.2",
"status": "affected",
"version": "4.11.2",
"versionType": "custom"
}
]
},
{
"product": "azure-keyvault-secrets",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "4.11.2",
"status": "affected",
"version": "4.11.2",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:azure_key_vault_client_sdk:*:*:*:*:*:*:*:*",
"versionStartIncluding": "-",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_keyvault_keys:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.10.2",
"versionStartIncluding": "4.11.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_keyvault_certificates:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.2",
"versionStartIncluding": "4.11.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_keyvault_secrets:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.11.2",
"versionStartIncluding": "4.11.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_keyvault_administration:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.8.2",
"versionStartIncluding": "4.7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-13T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Origin validation error in Azure Key Vault allows an unauthorized attacker to disclose information over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T16:59:36.395Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Azure Key Vault Information Disclosure Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88132"
}
],
"title": "Azure Key Vault Information Disclosure Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-88132",
"datePublished": "2026-10-13T19:00:21.850Z",
"dateReserved": "2026-09-09T21:53:00.397Z",
"dateUpdated": "2026-10-14T16:59:36.395Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85925 (GCVE-0-2026-85925)
Vulnerability from nvd – Published: 2026-10-13 19:01 – Updated: 2026-10-14 17:04
VLAI
EPSS
VEX
Title
Azure Key Vault Client SDK Elevation of Privilege Vulnerability
Summary
Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 20:03 UTC
CWE
- CWE-923 - Improper Restriction of Communication Channel to Intended Endpoints
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | azure-keyvault-administration |
Affected:
4.7.1 , < 4.8.1
(custom)
|
|
| Microsoft | azure-keyvault-certificates |
Affected:
4.11.2 , < 4.9.1
(custom)
|
|
| Microsoft | azure-keyvault-keys |
Affected:
4.11.2 , < 4.10.1
(custom)
|
|
| Microsoft | azure-keyvault-secrets |
Affected:
4.11.2 , < 4.11.1
(custom)
|
Date Public
2026-10-13 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85925",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T20:03:13.541336Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T20:12:53.560Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "azure-keyvault-administration",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "4.8.1",
"status": "affected",
"version": "4.7.1",
"versionType": "custom"
}
]
},
{
"product": "azure-keyvault-certificates",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "4.9.1",
"status": "affected",
"version": "4.11.2",
"versionType": "custom"
}
]
},
{
"product": "azure-keyvault-keys",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "4.10.1",
"status": "affected",
"version": "4.11.2",
"versionType": "custom"
}
]
},
{
"product": "azure-keyvault-secrets",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "4.11.1",
"status": "affected",
"version": "4.11.2",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:azure_keyvault_keys:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.10.1",
"versionStartIncluding": "4.11.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_keyvault_certificates:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.1",
"versionStartIncluding": "4.11.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_keyvault_secrets:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.11.1",
"versionStartIncluding": "4.11.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_keyvault_administration:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.8.1",
"versionStartIncluding": "4.7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-13T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-923",
"description": "CWE-923: Improper Restriction of Communication Channel to Intended Endpoints",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T17:04:13.062Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Azure Key Vault Client SDK Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85925"
}
],
"title": "Azure Key Vault Client SDK Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-85925",
"datePublished": "2026-10-13T19:01:09.254Z",
"dateReserved": "2026-09-04T18:24:41.250Z",
"dateUpdated": "2026-10-14T17:04:13.062Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85922 (GCVE-0-2026-85922)
Vulnerability from nvd – Published: 2026-10-13 19:01 – Updated: 2026-10-14 17:04
VLAI
EPSS
VEX
Title
Azure Key Vault Security Feature Bypass Vulnerability
Summary
Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 00:00 UTC
CWE
- CWE-1390 - Weak Authentication
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | azure_security_keyvault_certificates |
Affected:
1.0.1 , < 1.0.1
(custom)
|
|
| Microsoft | azure_security_keyvault_keys |
Affected:
1.0.1 , < 1.0.1
(custom)
|
|
| Microsoft | azure_security_keyvault_secrets |
Affected:
1.0.1 , < 1.0.1
(custom)
|
|
| Microsoft | azure-keyvault-administration |
Affected:
4.7.1 , < 4.7.1
(custom)
|
|
| Microsoft | azure-keyvault-certificates |
Affected:
4.11.2 , < 4.11.2
(custom)
|
|
| Microsoft | azure-keyvault-keys |
Affected:
4.11.2 , < 4.11.2
(custom)
|
|
| Microsoft | azure-keyvault-secrets |
Affected:
4.11.2 , < 4.11.2
(custom)
|
|
| Microsoft | azure-keyvault-securitydomain |
Affected:
1.0.0b3 , < 1.0.0b3
(custom)
|
Date Public
2026-10-13 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85922",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T03:57:22.222Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "azure_security_keyvault_certificates",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "1.0.1",
"status": "affected",
"version": "1.0.1",
"versionType": "custom"
}
]
},
{
"product": "azure_security_keyvault_keys",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "1.0.1",
"status": "affected",
"version": "1.0.1",
"versionType": "custom"
}
]
},
{
"product": "azure_security_keyvault_secrets",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "1.0.1",
"status": "affected",
"version": "1.0.1",
"versionType": "custom"
}
]
},
{
"product": "azure-keyvault-administration",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "4.7.1",
"status": "affected",
"version": "4.7.1",
"versionType": "custom"
}
]
},
{
"product": "azure-keyvault-certificates",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "4.11.2",
"status": "affected",
"version": "4.11.2",
"versionType": "custom"
}
]
},
{
"product": "azure-keyvault-keys",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "4.11.2",
"status": "affected",
"version": "4.11.2",
"versionType": "custom"
}
]
},
{
"product": "azure-keyvault-secrets",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "4.11.2",
"status": "affected",
"version": "4.11.2",
"versionType": "custom"
}
]
},
{
"product": "azure-keyvault-securitydomain",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "1.0.0b3",
"status": "affected",
"version": "1.0.0b3",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:azure_keyvault_secrets:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.11.2",
"versionStartIncluding": "4.11.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_keyvault_keys:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.11.2",
"versionStartIncluding": "4.11.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_keyvault_certificates:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.11.2",
"versionStartIncluding": "4.11.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_keyvault_administration:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.1",
"versionStartIncluding": "4.7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_keyvault_securitydomain:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.0b3",
"versionStartIncluding": "1.0.0b3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_security_keyvault_keys:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.1",
"versionStartIncluding": "1.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_security_keyvault_certificates:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.1",
"versionStartIncluding": "1.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_security_keyvault_secrets:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.1",
"versionStartIncluding": "1.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-13T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1390",
"description": "CWE-1390: Weak Authentication",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T17:04:12.529Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Azure Key Vault Security Feature Bypass Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85922"
}
],
"title": "Azure Key Vault Security Feature Bypass Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-85922",
"datePublished": "2026-10-13T19:01:09.179Z",
"dateReserved": "2026-09-04T18:24:41.250Z",
"dateUpdated": "2026-10-14T17:04:12.529Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85925 (GCVE-0-2026-85925)
Vulnerability from cvelistv5 – Published: 2026-10-13 19:01 – Updated: 2026-10-14 17:04
VLAI
EPSS
VEX
Title
Azure Key Vault Client SDK Elevation of Privilege Vulnerability
Summary
Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 20:03 UTC
CWE
- CWE-923 - Improper Restriction of Communication Channel to Intended Endpoints
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | azure-keyvault-administration |
Affected:
4.7.1 , < 4.8.1
(custom)
|
|
| Microsoft | azure-keyvault-certificates |
Affected:
4.11.2 , < 4.9.1
(custom)
|
|
| Microsoft | azure-keyvault-keys |
Affected:
4.11.2 , < 4.10.1
(custom)
|
|
| Microsoft | azure-keyvault-secrets |
Affected:
4.11.2 , < 4.11.1
(custom)
|
Date Public
2026-10-13 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85925",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T20:03:13.541336Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T20:12:53.560Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "azure-keyvault-administration",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "4.8.1",
"status": "affected",
"version": "4.7.1",
"versionType": "custom"
}
]
},
{
"product": "azure-keyvault-certificates",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "4.9.1",
"status": "affected",
"version": "4.11.2",
"versionType": "custom"
}
]
},
{
"product": "azure-keyvault-keys",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "4.10.1",
"status": "affected",
"version": "4.11.2",
"versionType": "custom"
}
]
},
{
"product": "azure-keyvault-secrets",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "4.11.1",
"status": "affected",
"version": "4.11.2",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:azure_keyvault_keys:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.10.1",
"versionStartIncluding": "4.11.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_keyvault_certificates:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.1",
"versionStartIncluding": "4.11.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_keyvault_secrets:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.11.1",
"versionStartIncluding": "4.11.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_keyvault_administration:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.8.1",
"versionStartIncluding": "4.7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-13T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-923",
"description": "CWE-923: Improper Restriction of Communication Channel to Intended Endpoints",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T17:04:13.062Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Azure Key Vault Client SDK Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85925"
}
],
"title": "Azure Key Vault Client SDK Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-85925",
"datePublished": "2026-10-13T19:01:09.254Z",
"dateReserved": "2026-09-04T18:24:41.250Z",
"dateUpdated": "2026-10-14T17:04:13.062Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85922 (GCVE-0-2026-85922)
Vulnerability from cvelistv5 – Published: 2026-10-13 19:01 – Updated: 2026-10-14 17:04
VLAI
EPSS
VEX
Title
Azure Key Vault Security Feature Bypass Vulnerability
Summary
Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 00:00 UTC
CWE
- CWE-1390 - Weak Authentication
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | azure_security_keyvault_certificates |
Affected:
1.0.1 , < 1.0.1
(custom)
|
|
| Microsoft | azure_security_keyvault_keys |
Affected:
1.0.1 , < 1.0.1
(custom)
|
|
| Microsoft | azure_security_keyvault_secrets |
Affected:
1.0.1 , < 1.0.1
(custom)
|
|
| Microsoft | azure-keyvault-administration |
Affected:
4.7.1 , < 4.7.1
(custom)
|
|
| Microsoft | azure-keyvault-certificates |
Affected:
4.11.2 , < 4.11.2
(custom)
|
|
| Microsoft | azure-keyvault-keys |
Affected:
4.11.2 , < 4.11.2
(custom)
|
|
| Microsoft | azure-keyvault-secrets |
Affected:
4.11.2 , < 4.11.2
(custom)
|
|
| Microsoft | azure-keyvault-securitydomain |
Affected:
1.0.0b3 , < 1.0.0b3
(custom)
|
Date Public
2026-10-13 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85922",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T03:57:22.222Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "azure_security_keyvault_certificates",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "1.0.1",
"status": "affected",
"version": "1.0.1",
"versionType": "custom"
}
]
},
{
"product": "azure_security_keyvault_keys",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "1.0.1",
"status": "affected",
"version": "1.0.1",
"versionType": "custom"
}
]
},
{
"product": "azure_security_keyvault_secrets",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "1.0.1",
"status": "affected",
"version": "1.0.1",
"versionType": "custom"
}
]
},
{
"product": "azure-keyvault-administration",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "4.7.1",
"status": "affected",
"version": "4.7.1",
"versionType": "custom"
}
]
},
{
"product": "azure-keyvault-certificates",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "4.11.2",
"status": "affected",
"version": "4.11.2",
"versionType": "custom"
}
]
},
{
"product": "azure-keyvault-keys",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "4.11.2",
"status": "affected",
"version": "4.11.2",
"versionType": "custom"
}
]
},
{
"product": "azure-keyvault-secrets",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "4.11.2",
"status": "affected",
"version": "4.11.2",
"versionType": "custom"
}
]
},
{
"product": "azure-keyvault-securitydomain",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "1.0.0b3",
"status": "affected",
"version": "1.0.0b3",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:azure_keyvault_secrets:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.11.2",
"versionStartIncluding": "4.11.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_keyvault_keys:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.11.2",
"versionStartIncluding": "4.11.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_keyvault_certificates:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.11.2",
"versionStartIncluding": "4.11.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_keyvault_administration:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.1",
"versionStartIncluding": "4.7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_keyvault_securitydomain:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.0b3",
"versionStartIncluding": "1.0.0b3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_security_keyvault_keys:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.1",
"versionStartIncluding": "1.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_security_keyvault_certificates:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.1",
"versionStartIncluding": "1.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_security_keyvault_secrets:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.1",
"versionStartIncluding": "1.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-13T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1390",
"description": "CWE-1390: Weak Authentication",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T17:04:12.529Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Azure Key Vault Security Feature Bypass Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85922"
}
],
"title": "Azure Key Vault Security Feature Bypass Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-85922",
"datePublished": "2026-10-13T19:01:09.179Z",
"dateReserved": "2026-09-04T18:24:41.250Z",
"dateUpdated": "2026-10-14T17:04:12.529Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88132 (GCVE-0-2026-88132)
Vulnerability from cvelistv5 – Published: 2026-10-13 19:00 – Updated: 2026-10-14 16:59
VLAI
EPSS
VEX
Title
Azure Key Vault Information Disclosure Vulnerability
Summary
Origin validation error in Azure Key Vault allows an unauthorized attacker to disclose information over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 19:55 UTC
CWE
- CWE-346 - Origin Validation Error
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Azure Key Vault Client SDK |
Affected:
-
|
|
| Microsoft | azure-keyvault-administration |
Affected:
4.7.1 , < 4.8.2
(custom)
|
|
| Microsoft | azure-keyvault-certificates |
Affected:
4.11.2 , < 4.9.2
(custom)
|
|
| Microsoft | azure-keyvault-keys |
Affected:
4.11.2 , < 4.10.2
(custom)
|
|
| Microsoft | azure-keyvault-secrets |
Affected:
4.11.2 , < 4.11.2
(custom)
|
Date Public
2026-10-13 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88132",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T19:55:39.344656Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T20:02:33.461Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Azure Key Vault Client SDK",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "-"
}
]
},
{
"product": "azure-keyvault-administration",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "4.8.2",
"status": "affected",
"version": "4.7.1",
"versionType": "custom"
}
]
},
{
"product": "azure-keyvault-certificates",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "4.9.2",
"status": "affected",
"version": "4.11.2",
"versionType": "custom"
}
]
},
{
"product": "azure-keyvault-keys",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "4.10.2",
"status": "affected",
"version": "4.11.2",
"versionType": "custom"
}
]
},
{
"product": "azure-keyvault-secrets",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "4.11.2",
"status": "affected",
"version": "4.11.2",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:azure_key_vault_client_sdk:*:*:*:*:*:*:*:*",
"versionStartIncluding": "-",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_keyvault_keys:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.10.2",
"versionStartIncluding": "4.11.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_keyvault_certificates:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.2",
"versionStartIncluding": "4.11.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_keyvault_secrets:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.11.2",
"versionStartIncluding": "4.11.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_keyvault_administration:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.8.2",
"versionStartIncluding": "4.7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-13T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Origin validation error in Azure Key Vault allows an unauthorized attacker to disclose information over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T16:59:36.395Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Azure Key Vault Information Disclosure Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88132"
}
],
"title": "Azure Key Vault Information Disclosure Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-88132",
"datePublished": "2026-10-13T19:00:21.850Z",
"dateReserved": "2026-09-09T21:53:00.397Z",
"dateUpdated": "2026-10-14T16:59:36.395Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}