CVE-2026-85925

Analyzed Analyzed - Analysis Complete

Improper Channel Restriction in Azure Key Vault Elevates Privileges

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: Microsoft Corporation

Description

Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-85925

EUVD

EUVD-2026-100127

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	azure-keyvault-administration	to 4.8.1 (exc)
microsoft	azure-keyvault-certificates	to 4.9.1 (exc)
microsoft	azure-keyvault-keys	to 4.10.1 (exc)
microsoft	azure-keyvault-secrets	to 4.11.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-923	The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper restriction of communication channels in Azure Key Vault. An authorized attacker can exploit this to elevate their privileges over a network by manipulating how the service communicates with intended endpoints.

Detection Guidance

Detection requires monitoring Azure Key Vault logs for unauthorized privilege elevation attempts. Check for unusual network traffic patterns targeting Key Vault endpoints. Use Azure Monitor to set alerts for suspicious activities like unexpected API calls or privilege changes.

Impact Analysis

An attacker could gain higher privileges than intended, potentially accessing sensitive data or performing unauthorized actions in Azure Key Vault. This could lead to data breaches or unauthorized modifications if exploited.

Compliance Impact

This vulnerability could lead to unauthorized access or data exposure, which may violate compliance requirements such as GDPR or HIPAA. Organizations using Azure Key Vault must address this to maintain regulatory compliance.

Mitigation Strategies

Apply the latest security updates from Microsoft for Azure Key Vault components to address improper communication channel restrictions.

Hi! I’m here to help you understand CVE-2026-85925. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70