What is the CVSS score of CVE-2026-62825?

CVE-2026-62825 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Azure Key Vault are affected by CVE-2026-62825?

A critical vulnerability in Microsoft Azure Key Vault exposes organizational credentials and cryptographic material to unauthorized access via remote unauthenticated attack.. A patch is available.

How to fix or mitigate CVE-2026-62825?

Within 24 hours: identify all Azure Key Vault instances and dependent systems across the organization; obtain vendor patch details and validate compatibility with current deployments. Within 7 days: apply patch to all Key Vault instances in production and lower environments; enable enhanced monitoring of Key Vault access during the patching window. Within 30 days: execute credential rotation for secrets stored in affected vaults, verify patch coverage across all instances, and conduct forensic review of access logs to identify any compromise activity.

Azure Key Vault CVE-2026-62825

EUVD-2026-48459 CRITICAL

Improper Authentication (CWE-287)

2026-07-24 microsoft

GHSA-8g4r-wj58-m98x

Authentication Bypass Microsoft Hashicorp Azure Key Vault

9.8

CVSS 3.1 · NVD

Severity by source

Vendor (microsoft) PRIMARY

CRITICAL

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Improper-authentication bypass reachable over the network with no privileges or interaction (AV:N/AC:L/PR:N/UI:N); unauthorized access to stored secrets and keys yields full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 07, 2026 - 19:43 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 07, 2026 - 19:37 vuln.today

cvss_changed

CVSS changed

Aug 07, 2026 - 19:37 NVD

10.0 (CRITICAL) 9.8 (CRITICAL)

Analysis Generated

Jul 24, 2026 - 00:49 vuln.today

CVE Published

Jul 24, 2026 - 00:01 cve.org

CRITICAL 10.0

DescriptionNVD

Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network.

AnalysisAI

Authentication bypass in Microsoft Azure Key Vault lets a remote, unauthenticated attacker elevate privileges over the network and gain unauthorized access to the secrets, keys, and certificates the service protects. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates it 9.8 Critical with full confidentiality, integrity, and availability impact. A vendor patch is available; there is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.70%, 49th percentile) despite CISA SSVC flagging the flaw as automatable with total technical impact.

Technical ContextAI

Azure Key Vault is Microsoft's cloud service for centrally storing and controlling access to cryptographic keys, secrets (passwords, connection strings, API tokens), and TLS certificates, typically accessed via its REST/data-plane API and gated by Microsoft Entra ID authentication and RBAC/access-policy authorization. The root cause is classified as CWE-287 (Improper Authentication), meaning the service failed to correctly verify caller identity, allowing a request to be accepted as authenticated (or as a higher-privileged principal) when it should have been rejected. Because Key Vault sits at the trust root for downstream applications that retrieve secrets and keys from it, a defect in its authentication layer undermines the security of every workload that depends on it.

RemediationAI

Patch available per vendor advisory - because Azure Key Vault is a Microsoft-managed cloud service, the fix is applied server-side by Microsoft rather than installed by customers, so review the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62825 to confirm the fix has rolled out to your regions and whether any customer action is required. As defense-in-depth that reduces exposure regardless of patch state, restrict Key Vault data-plane reachability by enabling Private Endpoints or the Key Vault firewall to allow only known VNets/IP ranges (trade-off: you must inventory and whitelist every legitimate caller or you will break applications), enforce least-privilege RBAC/access policies so no principal has more secret/key permissions than needed, and enable Key Vault diagnostic logging to Azure Monitor/Sentinel to hunt for anomalous or unauthenticated access attempts. As a precaution against a possible pre-patch bypass, rotate high-value secrets, keys, and certificates stored in exposed vaults, accepting the operational cost of coordinating dependent-application updates.