CVE-2026-33117

The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may bypass integrity verification checks. Operations delegated to the Key Vault service are not affected. The issue is addressed in version 4.10.6.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33117	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:microsoft:azure_sdk_for_java:*:*:*:*:*:*:*:*

History

26 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) La biblioteca de Java Key Vault Keys en el SDK de Azure para Java contiene un problema en la ruta de verificación criptográfica local donde la comparación de etiquetas de autenticación se implementó incorrectamente. En aplicaciones afectadas que utilizan la ruta de criptografía local vulnerable, una entrada cifrada especialmente diseñada puede eludir las comprobaciones de verificación de integridad. Las operaciones delegadas al servicio Key Vault no se ven afectadas. El problema se aborda en la versión 4.10.6.

Information

Published : 2026-05-12 18:17

Updated : 2026-10-26 18:10

NVD link : CVE-2026-33117

Mitre link : CVE-2026-33117

CVE.ORG link : CVE-2026-33117

JSON object : View

Products Affected

microsoft

azure_sdk_for_java

CWE

CWE-287

Improper Authentication

CWE-347

Improper Verification of Cryptographic Signature

{"id": "CVE-2026-33117", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33117", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-13T03:57:37.128659Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secure@microsoft.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "secure@microsoft.com", "affectedData": [{"vendor": "Microsoft", "product": "Azure SDK for Java", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "4.10.6", "versionType": "custom"}]}]}], "published": "2026-05-12T18:17:04.033", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33117", "tags": ["Vendor Advisory"], "source": "secure@microsoft.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "secure@microsoft.com", "description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-347"}]}], "descriptions": [{"lang": "en", "value": "The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may bypass integrity verification checks. Operations delegated to the Key Vault service are not affected. The issue is addressed in version 4.10.6."}, {"lang": "es", "value": "La biblioteca de Java Key Vault Keys en el SDK de Azure para Java contiene un problema en la ruta de verificaci\u00f3n criptogr\u00e1fica local donde la comparaci\u00f3n de etiquetas de autenticaci\u00f3n se implement\u00f3 incorrectamente. En aplicaciones afectadas que utilizan la ruta de criptograf\u00eda local vulnerable, una entrada cifrada especialmente dise\u00f1ada puede eludir las comprobaciones de verificaci\u00f3n de integridad. Las operaciones delegadas al servicio Key Vault no se ven afectadas. El problema se aborda en la versi\u00f3n 4.10.6."}], "lastModified": "2026-10-26T18:10:00.173", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:azure_sdk_for_java:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "45101624-5AAF-48EF-8188-E4AB088A49C2", "versionEndExcluding": "4.10.6"}], "operator": "OR"}]}], "sourceIdentifier": "secure@microsoft.com"}