What’s Vulnerable › Vulnerabilities
CVE-2026-85922: Azure Key Vault Security Feature Bypass Vulnerability
- Severity: high (CVSS 7.4 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.6% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-13 · updated 2026-10-31
- Weakness: CWE-1390
Description
Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network.
Affected products
- Microsoft azure-keyvault-administration: before 1.0.1; before 4.7.1 — fixed in 1.0.1, 4.7.1
- Microsoft azure-keyvault-certificates: before 1.0.1; before 4.11.2 — fixed in 1.0.1, 4.11.2
- Microsoft azure-keyvault-keys: before 4.11.2 — fixed in 4.11.2
- Microsoft azure-keyvault-secrets: before 1.0.1; before 4.11.2 — fixed in 1.0.1, 4.11.2
- Microsoft azure-keyvault-securitydomain: 1.0.0-beta1, 1.0.0-beta2
- Microsoft azure-keyvault-administration: from 4.7.1 before 4.7.1 — fixed in 4.7.1
- Microsoft azure-keyvault-certificates: from 4.11.2 before 4.11.2 — fixed in 4.11.2
- Microsoft azure-keyvault-keys: from 4.11.2 before 4.11.2 — fixed in 4.11.2
- Microsoft azure-keyvault-secrets: from 4.11.2 before 4.11.2 — fixed in 4.11.2
- Microsoft azure-keyvault-securitydomain: from 1.0.0b3 before 1.0.0b3 — fixed in 1.0.0b3
- Microsoft azure_security_keyvault_certificates: from 1.0.1 before 1.0.1 — fixed in 1.0.1
- Microsoft azure_security_keyvault_keys: from 1.0.1 before 1.0.1 — fixed in 1.0.1
- Microsoft azure_security_keyvault_secrets: from 1.0.1 before 1.0.1 — fixed in 1.0.1
How to fix
Upgrade to a fixed version: Microsoft azure-keyvault-administration 1.0.1, 4.7.1; Microsoft azure-keyvault-certificates 1.0.1, 4.11.2; Microsoft azure-keyvault-keys 4.11.2; Microsoft azure-keyvault-secrets 1.0.1, 4.11.2; Microsoft azure-keyvault-administration 4.7.1; Microsoft azure-keyvault-certificates 4.11.2; Microsoft azure-keyvault-keys 4.11.2; Microsoft azure-keyvault-secrets 4.11.2; Microsoft azure-keyvault-securitydomain 1.0.0b3; Microsoft azure_security_keyvault_certificates 1.0.1; Microsoft azure_security_keyvault_keys 1.0.1; Microsoft azure_security_keyvault_secrets 1.0.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-85922 or the next vulnerability affects your stack