CVE-2026-33117ImportantRevised 22 May
Azure SDK for Java Security Feature Bypass Vulnerability
Assessment
The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may bypass integrity verification checks. Operations delegated to the Key Vault service are not affected. The issue is addressed in version 4.10.6.
- Severity
- Important
- CVSS base score
- 9.1CVSS:3.1/
AV:N/ AC:L/ PR:N/ UI:N/ S:U/ C:H/ I:H/ A:N/ E:U/ RL:O/ RC:C - Impact
- Security Feature Bypass
- EPSS, next 30 days
- 0.5%Higher than 40.2% of scored CVEs · FIRST model run 29 Sep 2026 · about EPSS
- Public exploit code
- No Nuclei template lists it
- Exploitability
- Exploitation Unlikely
- Publicly disclosed
- No
- Customer action
- Required: apply the update
- Component
- Azure SDK
- Weakness
- CWE-287: Improper Authentication
- Issued by
- Microsoft
- Published
- 12 May 2026 · May 2026
- Last revised
- 22 May 2026The executive summary has been updated to include additional details about this vulnerability. This change does not affect the available security updates. Customers should install the recommended updates to remain protected from this vulnerability.
Updates that fix it
0 KBsNo KB listed
MSRC lists no downloadable update, which usually means a service-side fix or a release-notes update. Check the MSRC advisory.