Azure Key Vault Client SDK flaw lets attackers escalate privileges
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Microsoft Azure Key Vault Client SDK packages azure-keyvault-administration, azure-keyvault-certificates, azure-keyvault-keys and azure-keyvault-secrets are affected in the version ranges listed for each package. The SDK does not restrict its communication channel to the intended endpoints (CWE-923). An authorized attacker over the network can escalate privileges, though the attack is complex and requires low privileges and no user interaction.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a network.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | azure-keyvault-administration | 4.7.1 to before 4.8.1 | 4.8.1 | Patch available | CNA |
| Microsoft | azure-keyvault-certificates | 4.11.2 to before 4.9.1 | 4.9.1 | Patch available | CNA |
| Microsoft | azure-keyvault-keys | 4.11.2 to before 4.10.1 | 4.10.1 | Patch available | CNA |
| Microsoft | azure-keyvault-secrets | 4.11.2 to before 4.11.1 | 4.11.1 | Patch available | CNA |
- azure-keyvault-administration VendorMicrosoft Affected 4.7.1 to before 4.8.1 Fixed in 4.8.1 Patch available CNA
- azure-keyvault-certificates VendorMicrosoft Affected 4.11.2 to before 4.9.1 Fixed in 4.9.1 Patch available CNA
- azure-keyvault-keys VendorMicrosoft Affected 4.11.2 to before 4.10.1 Fixed in 4.10.1 Patch available CNA
- azure-keyvault-secrets VendorMicrosoft Affected 4.11.2 to before 4.11.1 Fixed in 4.11.1 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:azure-keyvault-administration:*:*:*:*:*:*:*:* | before 4.8.1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:azure-keyvault-certificates:*:*:*:*:*:-:*:* | before 4.9.1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:azure-keyvault-keys:*:*:*:*:*:-:*:* | before 4.10.1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:azure-keyvault-secrets:*:*:*:*:*:-:*:* | before 4.11.1 | Vulnerable | Microsoft |
- cpe:2.3:a:microsoft:azure-keyvault-administration:*:*:*:*:*:*:*:* Versions before 4.8.1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:azure-keyvault-certificates:*:*:*:*:*:-:*:* Versions before 4.9.1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:azure-keyvault-keys:*:*:*:*:*:-:*:* Versions before 4.10.1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:azure-keyvault-secrets:*:*:*:*:*:-:*:* Versions before 4.11.1 Vulnerable ·Microsoft
Remediation
Update azure-keyvault-administration to 4.8.1, azure-keyvault-certificates to 4.9.1, azure-keyvault-keys to 4.10.1 and azure-keyvault-secrets to 4.11.1.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA azure-keyvault-administration (Microsoft) Fixed in 4.8.1
- Fix · CNA azure-keyvault-certificates (Microsoft) Fixed in 4.9.1
- Fix · CNA azure-keyvault-keys (Microsoft) Fixed in 4.10.1
- Fix · CNA azure-keyvault-secrets (Microsoft) Fixed in 4.11.1
Timeline
- 2026-10-13 Threatist record created from CVE-2026-85925
- 2026-10-13 Alias added: GHSA-2gff-v97h-mc65
References
More Microsoft Azure-keyvault-administration vulnerabilities
- TI-2026-72832 Weak authentication in Azure Key Vault allows security bypass CVSS 3.1HIGH 7.4
Sources
- CVE-2026-85925 · CVE Program
- CVE-2026-85925 · NVD
- FIRST EPSS
- GHSA-2gff-v97h-mc65 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences