TI-2026-72918 Aliases CVE-2026-88132 GHSA-4h47-v37p-4458

Origin validation flaw in Azure Key Vault libraries leaks information

LOW 26CWE-346Published 2026-10-13 · Updated 2026-10-31

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-346.

Summary

Microsoft's azure-keyvault-administration, azure-keyvault-certificates, azure-keyvault-keys and azure-keyvault-secrets packages contain an origin validation error (CWE-346). An unauthorized remote attacker can disclose information over the network.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Origin validation error in Azure Key Vault allows an unauthorized attacker to disclose information over a network.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00319 25th percentileScored 2026-11-07

Fix Fixed azure-keyvault-administration (Microsoft): 4.8.2azure-keyvault-certificates (Microsoft): 4.9.2+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Microsoft	azure-keyvault-administration	4.7.1 to before 4.8.2	4.8.2	Patch available	CNA
Microsoft	azure-keyvault-certificates	4.11.2 to before 4.9.2	4.9.2	Patch available	CNA
Microsoft	azure-keyvault-keys	4.11.2 to before 4.10.2	4.10.2	Patch available	CNA
Microsoft	azure-keyvault-secrets	4.11.2 to before 4.11.2	4.11.2	Patch available	CNA

azure-keyvault-administration VendorMicrosoft Affected 4.7.1 to before 4.8.2 Fixed in 4.8.2 Patch available CNA
azure-keyvault-certificates VendorMicrosoft Affected 4.11.2 to before 4.9.2 Fixed in 4.9.2 Patch available CNA
azure-keyvault-keys VendorMicrosoft Affected 4.11.2 to before 4.10.2 Fixed in 4.10.2 Patch available CNA
azure-keyvault-secrets VendorMicrosoft Affected 4.11.2 to before 4.11.2 Fixed in 4.11.2 Patch available CNA

Remediation

Upgrade azure-keyvault-administration to 4.8.2, azure-keyvault-certificates to 4.9.2, azure-keyvault-keys to 4.10.2 and azure-keyvault-secrets to 4.11.2.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA azure-keyvault-administration (Microsoft) Fixed in 4.8.2
Fix · CNA azure-keyvault-certificates (Microsoft) Fixed in 4.9.2
Fix · CNA azure-keyvault-keys (Microsoft) Fixed in 4.10.2
Fix · CNA azure-keyvault-secrets (Microsoft) Fixed in 4.11.2

Timeline

2026-10-13 Threatist record created from CVE-2026-88132
2026-10-13 Alias added: GHSA-4h47-v37p-4458
2026-10-16 Affected versions changed · CNA

References

Patch 1

Azure Key Vault Information Disclosure Vulnerability

TI-2026-42212 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-37256 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-26194 Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-16982 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2025-36863 Windows Server Update Service (WSUS) Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2025-33671 Microsoft SharePoint Server Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8

See all 18045 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences