All vulnerabilities
CVE-2026-85922

azure_security_keyvault_certificates: Azure Key Vault Security Feature Bypass Vulnerability

Microsoft azure_security_keyvault_certificates
Open in ThreatlineRecord JSON
CVSS
7.4High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.54%Chance of exploitation activity in the next 30 days, higher than 44% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.0.1Also 4.7.1, 4.11.2 and 1 moreCVE List
Published13 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 1.0.1azure_security_keyvault_certificatesCVE List
  • 1.0.1azure_security_keyvault_keysCVE List
  • 1.0.1azure_security_keyvault_secretsCVE List
  • 4.7.1azure-keyvault-administrationCVE List
  • 4.11.2azure-keyvault-certificatesCVE List
  • 4.11.2azure-keyvault-keysCVE List
Show all 8 fixed versions
  • 4.11.2azure-keyvault-secretsCVE List
  • 1.0.0b3azure-keyvault-securitydomainCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Vendor and government advisories 1

Vendors that say their products are affected, and agencies that issued alerts. Check each for the fixed release of the product you run.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network.

Text from CVE List

Affected versions 8

  • azure_security_keyvault_certificatesaffected: 1.0.1 before 1.0.1CVE List
  • azure_security_keyvault_keysaffected: 1.0.1 before 1.0.1CVE List
  • azure_security_keyvault_secretsaffected: 1.0.1 before 1.0.1CVE List
  • azure-keyvault-administrationaffected: 4.7.1 before 4.7.1CVE List
  • azure-keyvault-certificatesaffected: 4.11.2 before 4.11.2CVE List
  • azure-keyvault-keysaffected: 4.11.2 before 4.11.2CVE List
  • azure-keyvault-secretsaffected: 4.11.2 before 4.11.2CVE List
  • azure-keyvault-securitydomainaffected: 1.0.0b3 before 1.0.0b3CVE List

References 1