Improper authentication in Azure Key Vault

CVE-2026-62825 is an improper authentication flaw (CWE-287) in the Azure Key Vault service plane. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H describes an unauthenticated network attacker bypassing the identity check that fronts Key Vault operations, resulting in scope-changed integrity and availability impact — meaning the compromise crosses the trust boundary from the caller into the Vault tenant itself. Because Key Vault is a multi-tenant cloud service rather than shrink-wrapped software, there is no version range to enumerate; every tenant that transacted with the vulnerable code path was potentially reachable until Microsoft's server-side fix rolled out on 2026-07-24.

Microsoft rated this CRITICAL / 10.0 and that rating matches reality. The C:N in the vector is misleading at first glance — no confidentiality impact — but the practical read is that an attacker with I:H on a Key Vault can *rotate, replace, or destroy* the keys and certs that protect everything downstream: TLS termination, disk encryption (SSE-CMK), Service Bus, SQL TDE, Storage account keys, and any customer-managed cryptographic material. Integrity compromise on a KMS is functionally equivalent to confidentiality compromise on everything the KMS protects. Do not let the C:N bait you into a downgrade.

Why this verdict

• Role multiplier — Key Vault is a canonical PKI/PAM tier. The chain succeeds directly against the high-value role; there is no 'low-value' deployment of a KMS. Outcome is tenant-wide integrity compromise of every secret, wrapped key, and cert. Floor = CRITICAL.
• Pre-auth + network-reachable. PR:N/UI:N/AV:N with default-public data-plane endpoints means the attacker prerequisite population is *every Azure customer with a Vault that has publicNetworkAccess=Enabled* — the majority per Microsoft's own posture telemetry.
• Scope change (S:C) is real. Integrity impact on a KMS propagates to every downstream service that trusts it — Storage CMK, SQL TDE, App Gateway TLS, AKS CSI secrets. C:N in the vector understates real-world confidentiality risk.
• Vendor fix is server-side and same-day, which caps active-exploitation risk but does *not* reduce the severity of the flaw — customers still owe themselves a log review and posture audit for the pre-patch window.

Why not higher?

10.0 is already the CVSS ceiling and CRITICAL is the top verdict bucket. We shave 0.2 from the vendor's 10.0 only to reflect that Microsoft's rapid server-side fix removes the ongoing exploit window, which materially reduces present-tense customer risk even though the historical exposure remains.

Why not lower?

Downgrading to HIGH would require evidence that the affected component is *not* a KMS — it is. The role multiplier hard-rule forbids dropping below the CRITICAL floor for a canonical high-value-role component with a plausible fleet-scale blast-radius chain, even though Microsoft owns the patch operationally.

1. Disable public network access on every Key Vault — Set publicNetworkAccess=Disabled and route callers via Private Endpoint or VNet Service Endpoint. This would have neutralized step 1 of the chain entirely. Deploy within 3 days per the noisgate mitigation SLA for CRITICAL.
2. Audit KeyVaultAuditEvent logs back to at least 2026-06-24 — Hunt for KeyCreate, KeyImport, SecretSet, CertificateImport, and KeyDelete events with unfamiliar CallerIPAddress or identity.claim.appid values. If diagnostic settings were never wired to Log Analytics, that gap itself is a finding. Complete within 3 days.
3. Rotate high-value keys and secrets stored pre-2026-07-24 — Even without confirmed exploitation, keys/secrets that protect regulated data (PCI, PHI, tokenization roots, code-signing) should be rotated as a precaution. Chain rotations through your CMK dependency graph. Complete within 30 days.
4. Enable Purge Protection and Soft Delete on every vault — Blocks destructive-attack finality even if data-plane auth is bypassed again. This is a one-way setting — turn it on now on every vault, no exceptions. Deploy within 3 days.
5. Enforce Conditional Access on Key Vault data-plane callers — Require compliant device + trusted location for principals with Key Vault Administrator, Key Vault Crypto Officer, and Key Vault Secrets Officer roles. Reduces blast radius of any future auth-related flaw. Deploy within 30 days.

Run from an auditor workstation with Az PowerShell module ≥ 11.0 and a signed-in identity that has at least Reader on the target subscriptions. Invoke as .\Check-KeyVaultPosture.ps1 -SubscriptionId <sub-guid>. Outputs VULNERABLE (public endpoint on, no Private Link), PATCHED (public access disabled or restricted), or UNKNOWN (query failed / permissions insufficient).

#requires -Version 7.0
#requires -Modules Az.Accounts, Az.KeyVault
<#
.SYNOPSIS
  Audit Azure Key Vault posture against CVE-2026-62825 fallout.
.DESCRIPTION
  The service-side flaw is patched by Microsoft. This script inspects
  customer-owned posture that would have limited blast radius:
    - publicNetworkAccess
    - network ACL default action
    - private endpoint presence
    - soft-delete / purge-protection
  Exit codes: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN
#>
param(
  [Parameter(Mandatory=$true)][string]$SubscriptionId
)

$ErrorActionPreference = 'Stop'
try {
  Select-AzSubscription -SubscriptionId $SubscriptionId | Out-Null
} catch {
  Write-Output 'UNKNOWN: cannot select subscription'
  exit 2
}

$vaults = @()
try { $vaults = Get-AzKeyVault } catch {
  Write-Output 'UNKNOWN: cannot enumerate vaults'
  exit 2
}

if (-not $vaults) {
  Write-Output 'PATCHED: no Key Vaults in subscription'
  exit 0
}

$vulnerable = @()
foreach ($v in $vaults) {
  $detail = Get-AzKeyVault -VaultName $v.VaultName -ResourceGroupName $v.ResourceGroupName
  $publicOn  = $detail.PublicNetworkAccess -ne 'Disabled'
  $aclOpen   = $detail.NetworkAcls.DefaultAction -ne 'Deny'
  $noPE      = -not ($detail.PrivateEndpointConnections)
  $noPurge   = -not $detail.EnablePurgeProtection
  $noSoftDel = -not $detail.EnableSoftDelete

  if (($publicOn -and $aclOpen -and $noPE) -or $noPurge -or $noSoftDel) {
    $vulnerable += [pscustomobject]@{
      Vault=$v.VaultName; PublicAccess=$publicOn; ACLOpen=$aclOpen;
      NoPrivateEndpoint=$noPE; NoPurgeProtection=$noPurge; NoSoftDelete=$noSoftDel
    }
  }
}

if ($vulnerable.Count -gt 0) {
  Write-Output 'VULNERABLE'
  $vulnerable | Format-Table -AutoSize
  exit 1
}
Write-Output 'PATCHED'
exit 0

Sources

1. MSRC advisory — CVE-2026-62825
2. OffSeq Threat Radar — CVE-2026-62825
3. Microsoft Learn — Authenticate to Azure Key Vault
4. Microsoft Learn — Secure your Azure Key Vault
5. CWE-287 — Improper Authentication
6. Azure Key Vault Private Link setup
7. CISA KEV Catalog
8. FIRST EPSS