Azure Key Vault CVE-2026-85925

Exploitation requires the attacker to already hold a valid low-privilege authorized identity able to interact with Azure Key Vault (PR:L), and it is not trivial: AC:H indicates specialized preconditions such as attacker-influenced network positioning or specific timing needed to steer the Key Vault communication channel to an unintended endpoint (CWE-923). The affected surface is applications using the vulnerable Azure Key Vault SDK client libraries (azure-keyvault-secrets, azure-keyvault-keys, azure-keyvault-certificates, azure-keyvault-administration); environments not using the vulnerable SDK versions, or that have applied the vendor patch, are not exposed. Limiting factors that reduce real-world risk: mandatory authentication, high attack complexity, no user interaction gain for the attacker, and no availability impact (A:N).

This is a genuine but second-tier priority rather than an emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N, base 8.2 High) shows a network-reachable flaw with scope change and high confidentiality/integrity impact, but two metrics temper the urgency: AC:H (high attack complexity, implying specialized conditions or timing the attacker does not control) and PR:L (the attacker must already hold a valid, low-privilege authorized identity in the Azure Key Vault environment). These line up with CISA's SSVC read - Exploitation: none, Automatable: no, Technical Impact: total - which signals a damaging-if-exploited but not-yet-exploited, non-mass-scannable issue. No EPSS score was provided, so statistical exploitation probability cannot be stated; no KEV listing and no POC exist, so exploitation is 'no public exploit identified at time of analysis.' In short, the CVSS and SSVC signals are consistent: high potential impact (total technical impact, scope change) balanced by meaningful barriers (authentication required, high complexity, not automatable), making this an important patch-soon item rather than a drop-everything KEV-grade threat.

An attacker who already possesses a low-privilege authorized identity within an Azure environment abuses the improper restriction of the Key Vault communication channel (CWE-923) to cause client traffic to reach an unintended endpoint, then leverages that to elevate privileges across a trust boundary. The high attack complexity means the attacker must satisfy non-trivial preconditions (such as network positioning or specific timing) rather than firing a single reliable request. No public exploit code or active exploitation has been identified.