Arqit vulnerabilities

Products

• Symmetric Key Agreement Platform 3

Latest Arqit CVEs

Newest publication first

1. CVE-2026-33585 Arqit SKA-Platform Improper Handling of Parameters Vulnerability

   Published 2026-05-13

   Low·CVSS 3.8 EPSS 0.13%

   Improper management of the idle timeout parameter in the Keycloak interface of the Arqit SKA-Platform enables an attacker to impersonate an authenticated tenant user via an unexpired browser session. This issue affects Symmetric Key Agreement Platform: before 26.03.

2. CVE-2026-33584 Arqit SKA-Platform Enables Access to Debug Information

   Published 2026-05-13

   Medium·CVSS 5.3 EPSS 0.31%

   Exposed Keycloak management service in the Arqit Symmetric Key Agreement Platform enables unauthorized access to sensitive debug information such as metrics and health data. This issue affects Symmetric Key Agreement Platform: before 26.03.

3. CVE-2026-33583 Arqit SKA-Platform Vulnerable to Key Exposure

   Published 2026-05-13

   High·CVSS 8.7 EPSS 0.21%

   Exposure of the QKEY (used as input into the ‘OTA-Quantum’ device registration process) and internal system keys via an unauthenticated and unencrypted HTTP GET method in the Arqit Symmetric Key Agreement Platform. This issue affects Symmetric Key Agreement Platform: before 26.03...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.