CVE-2026-85922: Microsoft Azure-Keyvault-Administration

High severity, CVSS 7.4. EPSS: 0.5% chance of exploitation in the next 30 days.

Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network.

Affected products

• Microsoft Azure-Keyvault-Administration: before 1.0.1 (fixed in 1.0.1); before 4.7.1 (fixed in 4.7.1)
• Microsoft Azure-Keyvault-Certificates: before 1.0.1 (fixed in 1.0.1); before 4.11.2 (fixed in 4.11.2)
• Microsoft Azure-Keyvault-Keys: before 4.11.2 (fixed in 4.11.2)
• Microsoft Azure-Keyvault-Secrets: before 1.0.1 (fixed in 1.0.1); before 4.11.2 (fixed in 4.11.2)
• Microsoft Azure-Keyvault-Securitydomain: version 1.0.0 only

Published 2026-10-13. Last modified 2026-10-16.