CVE-2026-85925: Azure Key Vault Client SDK Elevation of Privilege Vulnerability
Azure Key Vault Client SDK Elevation of Privilege Vulnerability
Other sources
Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.10.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.9.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.8.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.11.1
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker must already be authorized and have low privileges. Exploitation can be performed over the network and does not require user interaction.
Which SDK components are identified as affected?
The affected components listed are Microsoft azure-keyvault-certificates, azure-keyvault-keys, azure-keyvault-secrets, and azure-keyvault-administration.
What is the potential impact if exploitation succeeds?
A successful attack may allow elevation of privilege and has high confidentiality and integrity impact. Availability impact is listed as none.