CVE-2026-33117

The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may bypass integrity verification checks. Operations delegated to the Key Vault service are not affected. The issue is addressed in version 4.10.6.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33117	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:microsoft:azure_sdk_for_java:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-05-12 18:17

Updated : 2026-06-17 10:36

NVD link : CVE-2026-33117

Mitre link : CVE-2026-33117

CVE.ORG link : CVE-2026-33117

JSON object : View

Products Affected

microsoft

azure_sdk_for_java

CWE

CWE-287

Improper Authentication

CWE-347

Improper Verification of Cryptographic Signature

{"id": "CVE-2026-33117", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33117", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-13T03:57:37.128659Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secure@microsoft.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "secure@microsoft.com", "affectedData": [{"vendor": "Microsoft", "product": "Azure SDK for Java", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "4.10.6", "versionType": "custom"}]}]}], "published": "2026-05-12T18:17:04.033", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33117", "tags": ["Vendor Advisory"], "source": "secure@microsoft.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "secure@microsoft.com", "description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-347"}]}], "descriptions": [{"lang": "en", "value": "The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may bypass integrity verification checks. Operations delegated to the Key Vault service are not affected. The issue is addressed in version 4.10.6."}], "lastModified": "2026-06-17T10:36:58.553", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:azure_sdk_for_java:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "45101624-5AAF-48EF-8188-E4AB088A49C2", "versionEndExcluding": "4.10.6"}], "operator": "OR"}]}], "sourceIdentifier": "secure@microsoft.com"}