Is CVE-2026-33584 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33584 being exploited in the wild.

How severe is CVE-2026-33584?

Medium severity, with a CVSS score of 5.3, published 13 May 2026.

Which products and versions are affected?

Arqit Symmetric Key Agreement Platform before 26.03 (specifically 25.09.x and 25.12).

Is there a fix for CVE-2026-33584?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-33584 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-33584?

Check whether you run Arqit Symmetric Key Agreement Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33584: Arqit Symmetric Key Agreement Platform information disclosure in Keycloak service

CVE-2026-33584 · Severity: medium · CVSS 5.3 · Published 2026-05-13

The Arqit Symmetric Key Agreement Platform, which provides secure encryption key management, contains a configuration flaw that exposes internal diagnostic services. An unauthorized person could access sensitive system health data and performance metrics over the network. This information could be used by an attacker to gain insights into the system's internal operations or plan further attacks.

Technologies: Arqit Symmetric Key Agreement Platform. Vendors: Arqit.

Quick answers

Is CVE-2026-33584 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33584 being exploited in the wild.
How severe is CVE-2026-33584?: Medium severity, with a CVSS score of 5.3, published 13 May 2026.
Which products and versions are affected?: Arqit Symmetric Key Agreement Platform before 26.03 (specifically 25.09.x and 25.12).
Is there a fix for CVE-2026-33584?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-33584 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-33584?: Check whether you run Arqit Symmetric Key Agreement Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Arqit Symmetric Key Agreement Platform (SKA-Platform) fails to restrict access to the Keycloak management interface. This vulnerability, classified as CWE-749 (Exposed Dangerous Method or Function), allows a remote, unauthenticated attacker to retrieve sensitive debug information, including system metrics and health data, via unencrypted HTTP GET requests. The root cause is the exposure of an interface that Keycloak developers recommend keeping internal. The issue is resolved in version 26.03.

Affected products

Arqit Symmetric Key Agreement Platform before 26.03 (specifically 25.09.x and 25.12)

Timeline

2026-05-13: advisory: Initial publication of CVE-2026-33584
2026-05-13: disclosed: Vulnerability details made public by ENISA/CVCN

References

https://www.cvcn.gov.it/cvcn/cve/CVE-2026-33584

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.