The vulnerability arises from weak authentication controls in Azure Key Vault, allowing an attacker who is not authenticated to bypass a security feature over a network connection. This bypass permits the adversary to potentially read, write, or delete secrets, certificates, keys, and security domain configuration, compromising confidentiality, integrity, and availability of stored artifacts. The weakness is classified as Authentication Bypass (CWE‑1390).

Affected Microsoft Azure Key Vault components include administration, certificates, keys, secrets, and security domain services, along with their Azure Security equivalent modules. No specific product versions are listed in the CNA data.

The CVSS score of 7.4 indicates a high severity vulnerability, and while an EPSS score is not provided, the lack of a KEV listing suggests it has not yet been widely exploited in the field. The attacker would need only to send a specially crafted request to a vulnerable Key Vault instance, exploiting the authentication bypass to gain access. Consequently, the risk of exploitation remains significant for environments that rely on the affected services and have exposed endpoints.