CVE-2026-85922

Published: Oct 13, 2026Modified: Oct 16, 2026

7.4

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 2.2 / Impact: 5.2

Source: secure@microsoft.com (Secondary)

Description

Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network.

Affected (9)

Products: Microsoft: Azure Keyvault Administration, Azure Keyvault Certificates, Azure Keyvault Keys, Azure Keyvault Secrets, Azure Keyvault Securitydomain

5 products

Azure Keyvault Administration

Azure Keyvault Certificates

Azure Keyvault Keys

Azure Keyvault Secrets

Azure Keyvault Securitydomain

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Microsoft Azure Keyvault Administration	version < 4.7.1
Microsoft Azure Keyvault Administration	version < 1.0.1
Microsoft Azure Keyvault Certificates	version < 4.11.2
Microsoft Azure Keyvault Certificates	version < 1.0.1
Microsoft Azure Keyvault Keys	version < 4.11.2
Microsoft Azure Keyvault Secrets	version < 4.11.2
Microsoft Azure Keyvault Secrets	version < 1.0.1
Microsoft Azure Keyvault Securitydomain	Version 1.0.0 beta1
Microsoft Azure Keyvault Securitydomain	Version 1.0.0 beta2

Related CWEs

Weak Authentication

The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.

References (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85922

Source: secure@microsoft.com

Vendor Advisory

Timeline

No history available yet.