CVE-2026-33117: Azure SDK for Java Security Feature Bypass Vulnerability

Overview

Severity
Critical (CVSS 9.1)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
Category
Security Feature Bypass
Exploit Status
Not Exploited
Exploitation Likelihood
Unlikely
Patch Tuesday
2026-May
Released
2026-05-12

Description

Improper authentication in Azure SDK allows an unauthorized attacker to bypass a security feature over a network.

FAQ

What kind of security feature could be bypassed by successfully exploiting this vulnerability? Successful exploitation of this vulnerability could allow an attacker to bypass the integrity protection provided by the authentication tag that is designed to detect tampering with encrypted data. This may prevent the system from identifying whether encrypted content has been modified before it is decrypted. How could an attacker exploit this vulnerability? An attacker could exploit this vulnerability by sending specially crafted encrypted data to an affected application that uses the vulnerable decryption implementation and observing how the application responds. If the application is reachable over a network, this could allow the attacker to manipulate encrypted input in a way that bypasses integrity checks during decryption.

Affected Products (1)

Azure

  • Azure SDK for Java

Security Updates (1)

Acknowledgments

sho odagiri with <a href="https://gmo-cybersecurity.com/">GMO CyberSecurity by ierae inc</a>

Revision History

  • 2026-05-12: Information published.