CVE-2026-88132: CWE-346: Origin Validation Error in Microsoft Azure Key Vault Client SDK

This vulnerability (CVE-2026-88132) involves an origin validation error in the Azure Key Vault Client SDK, which could allow an unauthorized attacker to disclose sensitive information over a network. The flaw is categorized under CWE-346 (Origin Validation Error). The CVSS 3.1 base score is 5.9, reflecting network attack vector, high attack complexity, no privileges or user interaction required, and a confidentiality impact. Microsoft has published an official fix and manages remediation for this cloud service. No known exploits are reported in the wild.

An attacker exploiting this vulnerability could disclose sensitive information from the Azure Key Vault Client SDK over the network without requiring privileges or user interaction. The impact is limited to confidentiality, with no integrity or availability impact reported. The medium severity reflects the complexity and scope of the attack vector.

Microsoft has released an official fix for this vulnerability. Since Azure Key Vault is a cloud-hosted service, Microsoft manages the remediation server-side. Users should follow the guidance in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88132 to ensure their environments are updated and protected.