Azure Key Vault EUVD-2026-99656

Exploitation requires an application using the affected Azure Key Vault client SDK packages (azure-keyvault-administration, azure-keyvault-certificates, azure-keyvault-keys, azure-keyvault-secrets, and the Key Vault Client SDK) within the vulnerable version ranges, and the attacker must be able to supply or impersonate an unauthorized origin that the SDK fails to validate (CWE-346) - typically a network in-path/MITM or origin-spoofing position. No authentication is required (PR:N) and no user interaction (UI:N), but the high attack complexity (AC:H) is the primary limiting factor: the attacker must control or influence the network response/origin, which is not guaranteed in a properly segmented or TLS-pinned deployment. Patched SDK versions eliminate the flawed validation.

This is a medium-severity information-disclosure flaw (CVSS 5.9) whose real-world urgency is tempered by its attack-complexity and exploitation signals. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms a network-reachable, unauthenticated issue, but AC:H means successful exploitation depends on conditions outside the attacker's control (e.g. winning a race, forcing a malicious origin, or occupying a network path). The CISA SSVC framework reinforces a non-urgent posture: Exploitation=none, Automatable=no, Technical Impact=partial. There is no CISA KEV listing, no reported public POC, and no EPSS score in the provided data, so there is no evidence of active or at-scale exploitation at time of analysis. One mild tension to flag: the CVSS claims C:H (high confidentiality impact) while SSVC rates Technical Impact as only 'partial' - these are not fully consistent, so the true data-exposure blast radius should be verified against the MSRC advisory. Net: a real but lower-priority issue - patch on a normal cycle rather than as an emergency, prioritizing systems where Key Vault secrets are especially sensitive.

An attacker positioned on the network path between an application and Azure Key Vault (or able to present a spoofed/untrusted origin) leverages the SDK's origin-validation weakness so the client accepts responses from an unauthorized source, disclosing secrets, keys, or certificate material over the network. The high attack complexity (AC:H) means the attacker must first achieve a privileged network position or trigger the specific flawed validation path. No public exploit code has been identified at time of analysis.