# CVE-2026-33117: Azure SDK for Java Security Feature Bypass Vulnerability

> CVE-2026-33117: Azure SDK for Java Security Feature Bypass Vulnerability. CVSS 9.1 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-33117
Last updated: 2026-08-10T15:12:32Z

- Published: 2026-05-12 16:58 UTC · Updated: 2026-08-10 15:12 UTC · Assigner: microsoft
- CVSS: 9.1 (CVSS 3.1) · Severity: Critical · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
- EPSS: 0.48%, 41th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-287, CWE-347

## Description

The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may bypass integrity verification checks. Operations delegated to the Key Vault service are not affected. The issue is addressed in version 4.10.6.

## Affected vendors and products

- Microsoft: Azure SDK for Java

## Tracked companies

- [Microsoft Azure](https://rewindex.com/company/azure.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-33117)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-33117)
- [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33117](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33117)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-33117 · Markdown: https://rewindex.com/cve/CVE-2026-33117.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-33117 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:11:38.105Z