What is CVE-2026-85925?

CVE-2026-85925 is a security advisory published by Microsoft Security Response Center (MSRC) with High severity. Azure Key Vault Client SDK Elevation of Privilege Vulnerability

Which CVE IDs does CVE-2026-85925 cover?

CVE-2026-85925 covers the following CVE IDs: CVE-2026-85925. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of CVE-2026-85925?

CVE-2026-85925 has a CVSS v3 base score of 8.2, published by Microsoft Security Response Center (MSRC).

Which products are affected by CVE-2026-85925?

CVE-2026-85925 affects 4 products, including: azure-keyvault-administration; azure-keyvault-certificates; azure-keyvault-keys; azure-keyvault-secrets.

CVE-2026-85925HighCVSS 8.2

Azure Key Vault Client SDK Elevation of Privilege Vulnerability

Vendor

Microsoft Security Response Center (MSRC)

Published

October 13, 2026

Last Modified

—

🔗 CVE IDs covered (1)

CVE-2026-85925 →

📋 Description

Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a network.

🎯 Affected products4

azure-keyvault-administration
azure-keyvault-certificates
azure-keyvault-keys
azure-keyvault-secrets

✅ Remediation

KBRelease Notes (Security Update) — fixed build 4.10.1 KBRelease Notes (Security Update) — fixed build 4.9.1 KBRelease Notes (Security Update) — fixed build 4.11.1 KBRelease Notes (Security Update) — fixed build 4.8.1

🔗 References (9)

advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85925
patchhttps://www.nuget.org/packages/Azure.Security.KeyVault.Keys/4.10.1
referencehttps://github.com/Azure/azure-sdk-for-net/blob/Azure.Security.KeyVault.Keys_4.10.1/sdk/keyvault/Azure.Security.KeyVault.Keys/CHANGELOG.md
patchhttps://www.nuget.org/packages/Azure.Security.KeyVault.Certificates/4.9.1
referencehttps://github.com/Azure/azure-sdk-for-net/blob/Azure.Security.KeyVault.Certificates_4.9.1/sdk/keyvault/Azure.Security.KeyVault.Certificates/CHANGELOG.md
patchhttps://www.nuget.org/packages/Azure.Security.KeyVault.Secrets/4.11.1
referencehttps://github.com/Azure/azure-sdk-for-net/blob/Azure.Security.KeyVault.Secrets_4.11.1/sdk/keyvault/Azure.Security.KeyVault.Secrets/CHANGELOG.md
patchhttps://www.nuget.org/packages/Azure.Security.KeyVault.Administration/4.8.1
referencehttps://github.com/Azure/azure-sdk-for-net/blob/Azure.Security.KeyVault.Administration_4.8.1/sdk/keyvault/Azure.Security.KeyVault.Administration/CHANGELOG.md