CVE-2026-33117: Azure SDK for Java Security Feature Bypass Vulnerability
CVE-2026-33117 is a security feature bypass vulnerability in Azure SDK for Java, rated Important by Microsoft, with a CVSS 3.1 base score of 9.1 (Critical). An attacker can exploit it remotely over the network, without any privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as unlikely. The EPSS model estimates a 0.48% probability of exploitation activity in the next 30 days, higher than 42% of all scored vulnerabilities. Microsoft released the fix on 12 May 2026 in the May 2026 Patch Tuesday. It affects 1 product in 1 product family (Azure).
Key facts
- CVE ID
- CVE-2026-33117
- Severity
- Critical CVSS 9.1
- Microsoft severity
- Important
- Impact
- Security Feature Bypass
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- Unlikely
- Weakness
- CWE-287; CWE-347
- EPSS
- 0.48% (percentile 42%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- May 2026 Patch Tuesday
- Product families
- Azure
From the May 2026 Patch Tuesday briefing
Azure SDK for Java Security Feature Bypass
This vulnerability can allow an attacker to bypass intended security checks in applications using the Azure SDK for Java, undermining authentication or trust decisions the business assumes are enforced. A realistic scenario is an attacker abusing the bypass to impersonate a trusted identity, accept untrusted tokens/artifacts, or weaken validation, depending on how the SDK is used in your services. This CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) critical issue is a security feature bypass tied to improper authentication (CWE-287) and improper verification of cryptographic signature (CWE-347). The practical risk is not “someone attacks Azure” directly; it’s that applications relying on the Azure SDK for Java may incorrectly accept or validate authentication artifacts (tokens, signed assertions, or signed metadata), enabling attackers to bypass intended identity checks.
From the briefing, written by an AI model from PatchaPalooza's data.
CVSS score and vector
Microsoft scores CVE-2026-33117 at 9.1 (temporal 7.9) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality impact | High |
| Integrity impact | High |
| Availability impact | None |
| Exploit code maturity | Unproven |
| Remediation level | Official fix |
| Report confidence | Confirmed |
Description
The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may bypass integrity verification checks. Operations delegated to the Key Vault service are not affected. The issue is addressed in version 4.10.6.
Frequently asked questions (Microsoft)
What kind of security feature could be bypassed by successfully exploiting this vulnerability?
Successful exploitation of this vulnerability could allow an attacker to bypass the integrity protection provided by the authentication tag that is designed to detect tampering with encrypted data. This may prevent the system from identifying whether encrypted content has been modified before it is decrypted.
How could an attacker exploit this vulnerability?
An attacker could exploit this vulnerability by sending specially crafted encrypted data to an affected application that uses the vulnerable decryption implementation and observing how the application responds. If the application is reachable over a network, this could allow the attacker to manipulate encrypted input in a way that bypasses integrity checks during decryption.
Affected products (1)
Azure
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Azure SDK for Java | Release Notes | Security Update | 4.10.6 | No |
NIST NVD data
- NVD status
- Modified
- NVD CVSS
- 9.1 (CRITICAL)
- NVD weakness
- CWE-287; CWE-347
- Published to NVD
- NVD last modified
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| azure sdk for java | before 4.10.6 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33117 (Vendor Advisory)
Acknowledgments
- sho odagiri with GMO CyberSecurity by ierae inc
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. | |
| 1.1 | The executive summary has been updated to include additional details about this vulnerability. This change does not affect the available security updates. Customers should install the recommended updates to remain protected from this vulnerability. |