Microsoft Azure Key Vault Client SDK: Elevation of privilege
Summary
The Azure Key Vault Client SDK packages for Administration, Certificates, Keys and Secrets contain an improper restriction of communication channel to intended endpoints (CWE-923). According to Microsoft, an authorized attacker with low privileges on the network can obtain and reuse another user's Key Vault access token, which allows reading, changing or deleting secrets and performing cryptographic operations in that user's vault. The attack is rated high complexity, and the CVSS 3.1 base score is 8.2 (High).
Affected
- azure-keyvault-administration: 4.7.1 to before 4.8.1
- azure-keyvault-certificates, azure-keyvault-keys, azure-keyvault-secrets: affected version ranges listed in the CNA data are internally inconsistent; verify the exact ranges on the MSRC page
- Microsoft Azure Key Vault cloud service: not affected (client SDK only)
Fixed in
- azure-keyvault-administration: 4.8.1
- azure-keyvault-certificates, azure-keyvault-keys, azure-keyvault-secrets: Unknown; check the MSRC advisory for the fixed versions
Workaround
No workaround is provided in the CVE record.
Exploitation
- Not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof of concept or exploitation reports found in the sources checked.
Our recommendation
- Inventory where the affected azure-keyvault packages are used in your applications, build pipelines and dependency files.
- Update azure-keyvault-administration to 4.8.1 or later, and the other three packages to the fixed versions listed in the MSRC advisory.
- Prioritise internet-facing applications that use Key Vault or hold sensitive keys.
- Review Key Vault access policies and token lifetimes, and monitor Key Vault access logs for privilege escalation or anomalous activity.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Response Center advisory CVE-2026-85925 msrc.microsoft.com
- OpenCVE entry CVE-2026-85925 app.opencve.io
- NVD mirror (Vulners) CVE-2026-85925 vulners.com
- CNA mirror (Vulners) CVE-2026-85925 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:31.
Original description (NVD)
Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.