CVE-2026-85922: Azure Key Vault Security Feature Bypass Vulnerability
Azure Key Vault Security Feature Bypass Vulnerability
Other sources
Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.0.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.11.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.7.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.0.0b3
Event History
Frequently Asked Questions
Which components should be reviewed for exposure?
Review deployments that use the listed Azure Key Vault client packages: azure_security_keyvault_secrets, azure_security_keyvault_keys, azure_security_keyvault_certificates, azure-keyvault-certificates, azure-keyvault-securitydomain, azure-keyvault-administration, azure-keyvault-secrets, and azure-keyvault-keys.
Does exploitation require credentials or user interaction?
The vector indicates network-based exploitation with no privileges and no user interaction required. The attack complexity is rated high.
What security impact could successful exploitation have?
The vulnerability is rated as having high confidentiality and integrity impact, with no availability impact indicated.