Vulnerability · Published May 13, 2026 · Assigned by ENISA
CVE-2026-33585Arqit SKA-Platform Improper Handling of Parameters Vulnerability
Low 3.8
In plain English
A low-severity security flaw in Symmetric Key Agreement Platform from Arqit. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).
Severity (CVSS 3.1)3.8Low
Exploit odds (30 days)0.1%top 97.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Improper management of the idle timeout parameter in the Keycloak interface of the Arqit SKA-Platform enables an attacker to impersonate an authenticated tenant user via an unexpired browser session. This issue affects Symmetric Key Agreement Platform: before 26.03.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Arqit | Symmetric Key Agreement Platform | 0 – before 26.03 |
Weakness: CWE-233 · Vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
References
- https://www.cvcn.gov.it/cvcn/cve/CVE-2026-33585 third-party-advisory