Azure Key Vault Security Feature Bypass Vulnerability
CVE-2026-85922 is a security feature bypass vulnerability in Azure Key Vault (rated Important, CVSS 7.4).
1 version
Facts
- Microsoft id
CVE-2026-85922- Products
- Azure Key Vault
- Severity
- Important
- Impact
- Security Feature Bypass
- CVSS
- 7.4
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
- Exploited
- No
- Publicly disclosed
- No
- Exploitability
- Exploitation Less Likely
- Customer action required
- Yes
- Release
- 2026-Oct
- Assigned by
- Microsoft
- Weakness
- CWE-1390: Weak Authentication
- MSRC revision
- 1.0
- Status pages
- Azure Key Vault status
- First captured by us
- (from our first import of this list)
- Microsoft last modified
- Source
- Security updates · open the original at Microsoft
Microsoft's revision notes
- Revision 1.0, 2026-10-13:
Information published.
Microsoft says
Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network.
What Microsoft changed
One version so far. If Microsoft edits it, each change shows here with what was removed and added.
First version we captured ·
The text as we first saw it
Seen by us · Microsoft's timestamp · Microsoft's page
Related changes
Other changes for Azure Key Vault
- Azure Key Vault Client SDK Elevation of Privilege Vulnerability
- Azure Key Vault Information Disclosure Vulnerability
- Azure Key Vault Elevation of Privilege Vulnerability
- General availability: Improvements in Azure Key Vault · Launched
- Azure Policy for Key Vault now supports keys, secrets, and certificates · In preview
- General availability: 12 months free services for new Azure PAYG customers · Launched
- General availability: Azure governance policy for Azure Key Vault · Launched
- General availability of Azure Monitor for Key Vault and Azure Cache for Redis · Launched
Last updated