CVE-2026-85922

Analyzed Analyzed - Analysis Complete

Weak Authentication Bypass in Azure Key Vault

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: Microsoft Corporation

Description

Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-85922

EUVD

EUVD-2026-100126

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	azure-keyvault-administration	to 4.7.1 (exc)
microsoft	azure-keyvault-administration	to 1.0.1 (exc)
microsoft	azure-keyvault-certificates	to 4.11.2 (exc)
microsoft	azure-keyvault-certificates	to 1.0.1 (exc)
microsoft	azure-keyvault-keys	to 4.11.2 (exc)
microsoft	azure-keyvault-secrets	to 4.11.2 (exc)
microsoft	azure-keyvault-secrets	to 1.0.1 (exc)
microsoft	azure-keyvault-securitydomain	1.0.0
microsoft	azure-keyvault-securitydomain	1.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1390	The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.

Attack-Flow Graph

Executive Summary

This vulnerability involves weak authentication in Azure Key Vault that enables an unauthorized attacker to bypass a security feature remotely over a network.

Detection Guidance

This vulnerability involves weak authentication in Azure Key Vault allowing bypass of security features. Detection requires checking Azure Key Vault configurations and authentication logs for unusual access patterns or failed security feature validations.

Impact Analysis

An attacker could exploit this to gain unauthorized access to sensitive data stored in Azure Key Vault, potentially leading to data breaches or unauthorized operations.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, or other regulations due to unauthorized data access or breaches, resulting in legal penalties or reputational damage.

Mitigation Strategies

Apply the latest security updates from Microsoft for Azure Key Vault components as soon as they become available to address the weak authentication issue.

Hi! I’m here to help you understand CVE-2026-85922. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70