Weak authentication in Azure Key Vault allows security bypass
Priority LOW 35CWE-1390Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Weak authentication in Microsoft Azure Key Vault packages, such as azure-keyvault-keys and azure-keyvault-secrets, lets attackers bypass a security feature (CWE-1390). An unauthorized remote attacker needs no privileges or user interaction over a network, but the attack is hard to carry out. A successful attack can compromise confidentiality and integrity.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00608 49th percentileScored 2026-11-07
Fix Fixed azure_security_keyvault_certificates (Microsoft): 1.0.1azure_security_keyvault_keys (Microsoft): 1.0.1+6 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | azure_security_keyvault_certificates | 1.0.1 to before 1.0.1 | 1.0.1 | Patch available | CNA |
| Microsoft | azure_security_keyvault_keys | 1.0.1 to before 1.0.1 | 1.0.1 | Patch available | CNA |
| Microsoft | azure_security_keyvault_secrets | 1.0.1 to before 1.0.1 | 1.0.1 | Patch available | CNA |
| Microsoft | azure-keyvault-administration | 4.7.1 to before 4.7.1 | 4.7.1 | Patch available | CNA |
| Microsoft | azure-keyvault-certificates | 4.11.2 to before 4.11.2 | 4.11.2 | Patch available | CNA |
| Microsoft | azure-keyvault-keys | 4.11.2 to before 4.11.2 | 4.11.2 | Patch available | CNA |
| Microsoft | azure-keyvault-secrets | 4.11.2 to before 4.11.2 | 4.11.2 | Patch available | CNA |
| Microsoft | azure-keyvault-securitydomain | 1.0.0b3 to before 1.0.0b3 | 1.0.0b3 | Patch available | CNA |
- azure_security_keyvault_certificates VendorMicrosoft Affected 1.0.1 to before 1.0.1 Fixed in 1.0.1 Patch available CNA
- azure_security_keyvault_keys VendorMicrosoft Affected 1.0.1 to before 1.0.1 Fixed in 1.0.1 Patch available CNA
- azure_security_keyvault_secrets VendorMicrosoft Affected 1.0.1 to before 1.0.1 Fixed in 1.0.1 Patch available CNA
- azure-keyvault-administration VendorMicrosoft Affected 4.7.1 to before 4.7.1 Fixed in 4.7.1 Patch available CNA
- azure-keyvault-certificates VendorMicrosoft Affected 4.11.2 to before 4.11.2 Fixed in 4.11.2 Patch available CNA
- azure-keyvault-keys VendorMicrosoft Affected 4.11.2 to before 4.11.2 Fixed in 4.11.2 Patch available CNA
- azure-keyvault-secrets VendorMicrosoft Affected 4.11.2 to before 4.11.2 Fixed in 4.11.2 Patch available CNA
- azure-keyvault-securitydomain VendorMicrosoft Affected 1.0.0b3 to before 1.0.0b3 Fixed in 1.0.0b3 Patch available CNA
CPE configurations NVD · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:azure-keyvault-administration:*:*:*:*:*:rust:*:* | before 1.0.1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:azure-keyvault-administration:*:*:*:*:*:-:*:* | before 4.7.1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:azure-keyvault-certificates:*:*:*:*:*:rust:*:* | before 1.0.1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:azure-keyvault-certificates:*:*:*:*:*:-:*:* | before 4.11.2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:azure-keyvault-keys:*:*:*:*:*:*:*:* | before 4.11.2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:azure-keyvault-secrets:*:*:*:*:*:rust:*:* | before 1.0.1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:azure-keyvault-secrets:*:*:*:*:*:-:*:* | before 4.11.2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:azure-keyvault-securitydomain:1.0.0:beta1:*:*:*:*:*:* | 1.0.0 beta1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:azure-keyvault-securitydomain:1.0.0:beta2:*:*:*:*:*:* | 1.0.0 beta2 | Vulnerable | Microsoft |
- cpe:2.3:a:microsoft:azure-keyvault-administration:*:*:*:*:*:rust:*:* Versions before 1.0.1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:azure-keyvault-administration:*:*:*:*:*:-:*:* Versions before 4.7.1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:azure-keyvault-certificates:*:*:*:*:*:rust:*:* Versions before 1.0.1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:azure-keyvault-certificates:*:*:*:*:*:-:*:* Versions before 4.11.2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:azure-keyvault-keys:*:*:*:*:*:*:*:* Versions before 4.11.2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:azure-keyvault-secrets:*:*:*:*:*:rust:*:* Versions before 1.0.1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:azure-keyvault-secrets:*:*:*:*:*:-:*:* Versions before 4.11.2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:azure-keyvault-securitydomain:1.0.0:beta1:*:*:*:*:*:* Versions 1.0.0 beta1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:azure-keyvault-securitydomain:1.0.0:beta2:*:*:*:*:*:* Versions 1.0.0 beta2 Vulnerable ·Microsoft
Remediation
Install fixed versions: azure_security_keyvault_certificates, azure_security_keyvault_keys and azure_security_keyvault_secrets 1.0.1; azure-keyvault-administration 4.7.1; azure-keyvault-certificates, azure-keyvault-keys and azure-keyvault-secrets 4.11.2; azure-keyvault-securitydomain 1.0.0b3.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA azure_security_keyvault_certificates (Microsoft) Fixed in 1.0.1
- Fix · CNA azure_security_keyvault_keys (Microsoft) Fixed in 1.0.1
- Fix · CNA azure_security_keyvault_secrets (Microsoft) Fixed in 1.0.1
- Fix · CNA azure-keyvault-administration (Microsoft) Fixed in 4.7.1
- Fix · CNA azure-keyvault-certificates (Microsoft) Fixed in 4.11.2
- Fix · CNA azure-keyvault-keys (Microsoft) Fixed in 4.11.2
- Fix · CNA azure-keyvault-secrets (Microsoft) Fixed in 4.11.2
- Fix · CNA azure-keyvault-securitydomain (Microsoft) Fixed in 1.0.0b3
Timeline
- 2026-10-13 Threatist record created from CVE-2026-85922
- 2026-10-13 Alias added: GHSA-9fc6-4x25-jwhj
- 2026-10-14 CISA SSVC decision points changed
- 2026-10-14 Priority changed: MEDIUM → LOW
- 2026-10-14 CISA SSVC decision points changed
References
More Microsoft Azure-keyvault-administration vulnerabilities
- TI-2026-72833 Azure Key Vault Client SDK flaw lets attackers escalate privileges CVSS 3.1HIGH 8.2
Sources
- CVE-2026-85922 · CVE Program
- CVE-2026-85922 · NVD
- FIRST EPSS
- GHSA-9fc6-4x25-jwhj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences