Description
Origin validation error in Azure Key Vault allows an unauthorized attacker to disclose information over a network.
Published: 2026-10-13
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Assess Impact
AI Analysis

Impact

An origin validation error in Azure Key Vault allows an unauthorized attacker to disclose information across the network. The flaw permits access to data that should be restricted to authenticated clients, resulting in potential leakage of sensitive configuration or keys.

Affected Systems

Microsoft Azure Key Vault Client SDK, Azure Key Vault Administration, Azure Key Vault Certificates, Azure Key Vault Keys, Azure Key Vault Secrets are impacted. Specific versions are not specified in the advisory, so all currently deployed versions may be vulnerable until a patch is released.

Risk and Exploitability

The CVSS score of 5.9 indicates moderate severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through network communication with Azure Key Vault; an attacker would need to interact with the service over the network to exploit the origin validation flaw.

Generated by OpenCVE AI on October 16, 2026 at 06:12 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88132 for any updated versions and apply the recommended patch once available.
  • Update the Azure Key Vault Client SDK and related Azure Key Vault libraries to the latest patched releases as soon as they are available.
  • Implement network controls to limit exposure, such as restricting outbound traffic to Azure Key Vault endpoints, to mitigate the risk of an exploit while a patch is pending.

Generated by OpenCVE AI on October 16, 2026 at 06:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 13:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:microsoft:azure_key_vault_client_sdk:*:*:*:*:*:*:*:*
Vendors & Products Microsoft azure Key Vault Client Sdk

Wed, 14 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 19:15:00 +0000

Type Values Removed Values Added
Description Origin validation error in Azure Key Vault allows an unauthorized attacker to disclose information over a network.
Title Azure Key Vault Information Disclosure Vulnerability
First Time appeared Microsoft
Microsoft azure Key Vault Client Sdk
Microsoft azure Keyvault Administration
Microsoft azure Keyvault Certificates
Microsoft azure Keyvault Keys
Microsoft azure Keyvault Secrets
Weaknesses CWE-346
CPEs cpe:2.3:a:microsoft:azure_key_vault_client_sdk:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:azure_keyvault_administration:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:azure_keyvault_certificates:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:azure_keyvault_keys:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:azure_keyvault_secrets:*:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft azure Key Vault Client Sdk
Microsoft azure Keyvault Administration
Microsoft azure Keyvault Certificates
Microsoft azure Keyvault Keys
Microsoft azure Keyvault Secrets
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C'}

Subscriptions

Microsoft Azure Keyvault Administration Azure Keyvault Certificates Azure Keyvault Keys Azure Keyvault Secrets
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2026-10-31T18:05:56.641Z

Reserved: 2026-09-09T21:53:00.397Z

Link: CVE-2026-88132

cve-icon Vulnrichment

Updated: 2026-10-13T19:55:40.120Z

cve-icon NVD

Status : Undergoing Analysis

Published: 2026-10-13T19:21:32.373

Modified: 2026-10-16T14:19:03.607

Link: CVE-2026-88132

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-18T09:15:16Z

Weaknesses