Azure Key Vault CVE-2026-85922

Exploitation is limited to applications or services running a vulnerable Azure Key Vault client SDK version - specifically Python packages azure-keyvault-administration (<4.7.1), azure-keyvault-securitydomain (<1.0.0b3), azure-keyvault-certificates/secrets/keys (<4.11.2), and .NET packages Azure.Security.KeyVault.Certificates/Secrets/Keys (<1.0.1); deployments already on patched versions are not exposed. Although the CVSS vector is PR:N/UI:N (no authentication or user interaction required), AC:H signals a meaningful limiting factor: the attacker must satisfy a specific non-trivial precondition - such as a timing/race window, a particular configuration, or an intermediary network position - rather than exploit a default configuration with a single request. The precise triggering condition is not disclosed in the available data and should be confirmed from the MSRC advisory.

This is a moderate-priority issue rather than an urgent fire-drill, and the signals are internally consistent on that point. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, base 7.4 HIGH) describes a network-reachable, unauthenticated security-feature/authentication bypass with high confidentiality and integrity impact but - importantly - high attack complexity (AC:H), which materially dampens real-world exploitability because the attacker must win some race, meet a specific precondition, or control non-default state. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active or at-scale exploitation; exploitation status is best described as no public exploit identified at time of analysis. A notable cross-reference tension: the description says 'Azure Key Vault' (which would normally imply the hosted cloud service), yet the EUVD affected-version list is composed entirely of Azure Key Vault *client SDK* package versions (azure-keyvault-secrets/keys/certificates/administration/securitydomain for Python and azure_security_keyvault_* for .NET) - this strongly suggests the flaw is in the client libraries rather than the Microsoft-operated service, which changes the remediation model from 'Microsoft patches it for you' to 'you must upgrade your SDK dependency.' This discrepancy should be verified against the MSRC advisory. CWE-1390 (weak authentication) aligns with the 'authentication bypass' framing. Net: a legitimately HIGH-severity bug worth patching promptly, but AC:H plus absence of EPSS/KEV/POC signals argue against emergency treatment.

An attacker positioned to interact with an application that uses a vulnerable Azure Key Vault client SDK version exploits the weak authentication logic to bypass an intended security/authentication check and gain unauthorized read or manipulation access to secrets, keys, or certificate operations. The high attack complexity (AC:H) means the attacker likely must meet a specific timing or configuration precondition rather than firing a single trivial request. No public exploit code is identified at time of analysis.