Azure Keyvault Keys
Monthly
Privilege escalation through the Azure Key Vault SDK client libraries (azure-keyvault-secrets, azure-keyvault-keys, azure-keyvault-certificates and azure-keyvault-administration) allows an authorized attacker who already holds a valid low-privilege Key Vault identity to steer the SDK's communication channel toward an unintended endpoint, exposing secrets, keys and certificates and thereby gaining the vault's data-plane privileges. Exploitation is not trivial: the assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) requires an authenticated low-privilege identity plus specialized preconditions such as attacker-influenced network positioning or precise timing, with no user interaction and no availability impact, while scope is changed because compromise of the client library reaches the Key Vault resource itself. No confirmed active exploitation (not listed in CISA KEV) and no public exploit code were identified at time of analysis, and CISA's SSVC decision framework rates Exploitation as 'none' and Automatable as 'no', although Technical Impact is rated total; Microsoft has released a vendor patch. This is a genuine but second-tier priority rather than an emergency.
Weak authentication handling in Microsoft's Azure Key Vault integration libraries allows unauthenticated remote attackers to bypass a security feature, with high confidentiality and integrity impact but no availability impact. The exposure is limited to applications and services that depend on specific vulnerable client SDK versions - the Python packages azure-keyvault-administration (<4.7.1), azure-keyvault-securitydomain (<1.0.0b3), and azure-keyvault-certificates/secrets/keys (<4.11.2), plus the .NET packages Azure.Security.KeyVault.Certificates/Secrets/Keys (<1.0.1); deployments already on patched versions are not exposed. Although the CVSS 3.1 vector (7.4, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates no authentication or user interaction is required, the High Attack Complexity reflects a meaningful non-trivial precondition - a timing or race window, a specific configuration, or an intermediary network position - rather than a single-request exploit of a default setup; no public exploit code has been identified at time of analysis, and this is a moderate-priority issue rather than an urgent fire drill.
Privilege escalation through the Azure Key Vault SDK client libraries (azure-keyvault-secrets, azure-keyvault-keys, azure-keyvault-certificates and azure-keyvault-administration) allows an authorized attacker who already holds a valid low-privilege Key Vault identity to steer the SDK's communication channel toward an unintended endpoint, exposing secrets, keys and certificates and thereby gaining the vault's data-plane privileges. Exploitation is not trivial: the assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) requires an authenticated low-privilege identity plus specialized preconditions such as attacker-influenced network positioning or precise timing, with no user interaction and no availability impact, while scope is changed because compromise of the client library reaches the Key Vault resource itself. No confirmed active exploitation (not listed in CISA KEV) and no public exploit code were identified at time of analysis, and CISA's SSVC decision framework rates Exploitation as 'none' and Automatable as 'no', although Technical Impact is rated total; Microsoft has released a vendor patch. This is a genuine but second-tier priority rather than an emergency.
Weak authentication handling in Microsoft's Azure Key Vault integration libraries allows unauthenticated remote attackers to bypass a security feature, with high confidentiality and integrity impact but no availability impact. The exposure is limited to applications and services that depend on specific vulnerable client SDK versions - the Python packages azure-keyvault-administration (<4.7.1), azure-keyvault-securitydomain (<1.0.0b3), and azure-keyvault-certificates/secrets/keys (<4.11.2), plus the .NET packages Azure.Security.KeyVault.Certificates/Secrets/Keys (<1.0.1); deployments already on patched versions are not exposed. Although the CVSS 3.1 vector (7.4, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates no authentication or user interaction is required, the High Attack Complexity reflects a meaningful non-trivial precondition - a timing or race window, a specific configuration, or an intermediary network position - rather than a single-request exploit of a default setup; no public exploit code has been identified at time of analysis, and this is a moderate-priority issue rather than an urgent fire drill.