CVE-2026-33117: Azure SDK for Java Security Feature Bypass Vulnerability

Overview

Severity
Critical (CVSS 9.1)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
Category
Security Feature Bypass
Exploit Status
Not Exploited
Exploitation Likelihood
Unlikely
Patch Tuesday
2026-May
Released
2026-05-12
Last Updated
2026-05-22
EPSS Score
0.48% (percentile: 37.8%)

Description

The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may bypass integrity verification checks. Operations delegated to the Key Vault service are not affected. The issue is addressed in version 4.10.6.

FAQ

What kind of security feature could be bypassed by successfully exploiting this vulnerability? Successful exploitation of this vulnerability could allow an attacker to bypass the integrity protection provided by the authentication tag that is designed to detect tampering with encrypted data. This may prevent the system from identifying whether encrypted content has been modified before it is decrypted. How could an attacker exploit this vulnerability? An attacker could exploit this vulnerability by sending specially crafted encrypted data to an affected application that uses the vulnerable decryption implementation and observing how the application responds. If the application is reachable over a network, this could allow the attacker to manipulate encrypted input in a way that bypasses integrity checks during decryption.

Affected Products (1)

Azure

  • Azure SDK for Java

Security Updates (1)

Acknowledgments

sho odagiri with <a href="https://gmo-cybersecurity.com/">GMO CyberSecurity by ierae inc</a>

Revision History

  • 2026-05-12: Information published.
  • 2026-05-22: The executive summary has been updated to include additional details about this vulnerability. This change does not affect the available security updates. Customers should install the recommended updates to remain protected from this vulnerability.