CVE-2026-33583

HighCVSS 8.7

Published: 13/05/2026(UTC)Updated: 26/10/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Summary

CVE-2026-33583 vulnerability involves the exposure of the QKEY and internal system keys via an unauthenticated and unencrypted HTTP GET method in the Arqit Symmetric Key Agreement Platform. This issue affects versions of the platform before 26.03.

Risk Assessment

The exposure of keys may lead to security compromise, allowing attackers to take control of the device registration process. This poses a serious threat to the confidentiality and integrity of data.

Recommendation

It is recommended to update the Arqit Symmetric Key Agreement Platform to a version after 26.03 to eliminate this vulnerability. Additionally, implement security measures such as encryption and authorization for all access methods.

Other vulnerabilities in Arqit Symmetric Key Agreement Platform

CVE-2026-33584Medium
An exposed Keycloak management service in the Arqit Symmetric Key Agreement Platform enables unauthorized access to sensitive debug information such as metrics and health data. This issue affects versions before 26.03.

Original NVD description (English source)

Exposure of the QKEY (used as input into the ‘OTA-Quantum’ device registration process) and internal system keys via an unauthenticated and unencrypted HTTP GET method in the Arqit Symmetric Key Agreement Platform. This issue affects Symmetric Key Agreement Platform: before 26.03.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS