This vulnerability (CVE-2026-33583) affects the Arqit Symmetric Key Agreement Platform versions before 26.03. It arises from an exposed dangerous method (CWE-749) that allows unauthenticated attackers to retrieve the QKEY and internal system keys via an unencrypted HTTP GET request. The QKEY is critical as it is used as input in the OTA-Quantum device registration process. The vulnerability has a CVSS 3.1 base score of 8.7, reflecting high impact on confidentiality and integrity with network attack vector, high attack complexity, no privileges or user interaction required, and scope change. No patch or official remediation level has been published by the vendor, and the product is not a cloud service.

Successful exploitation would result in exposure of highly sensitive cryptographic keys, leading to complete compromise of confidentiality and integrity of the key agreement platform and potentially all dependent systems. The vulnerability does not impact availability. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid exposing the affected HTTP GET method to untrusted networks and consider network-level controls to restrict access. Monitor vendor communications for updates on patches or official mitigations.