CVE-2026-33583: Arqit Symmetric Key Agreement Platform

High severity, CVSS 8.7. EPSS: 0.3% chance of exploitation in the next 30 days.

Exposure of the QKEY (used as input into the ‘OTA-Quantum’ device registration process) and internal system keys via an unauthenticated and unencrypted HTTP GET method in the Arqit Symmetric Key Agreement Platform. This issue affects Symmetric Key Agreement Platform: before 26.03.

Affected products

• Arqit Symmetric Key Agreement Platform: before 26.03 (fixed in 26.03)

Published 2026-05-13. Last modified 2026-06-17.