CVE-2026-85925

Published: Oct 13, 2026Modified: Oct 16, 2026

8.2

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Exploitability: 1.8 / Impact: 5.8

Source: secure@microsoft.com (Secondary)

Description

Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a network.

Affected (4)

Products: Microsoft: Azure Keyvault Administration, Azure Keyvault Certificates, Azure Keyvault Keys, Azure Keyvault Secrets

Microsoft

4 products

Azure Keyvault Administration

Azure Keyvault Certificates

Azure Keyvault Keys

Azure Keyvault Secrets

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Microsoft Azure Keyvault Administration	version < 4.8.1
Microsoft Azure Keyvault Certificates	version < 4.9.1
Microsoft Azure Keyvault Keys	version < 4.10.1
Microsoft Azure Keyvault Secrets	version < 4.11.1

Related CWEs

CWE-923

Improper Restriction of Communication Channel to Intended Endpoints

The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.

References (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85925

Source: secure@microsoft.com

Vendor Advisory

Timeline

No history available yet.