CVE-2026-33117
Azure SDK for Java Security Feature Bypass Vulnerability
CVSS Score
9.1
EPSS Score
0.0%
EPSS Percentile
0th
The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may bypass integrity verification checks. Operations delegated to the Key Vault service are not affected. The issue is addressed in version 4.10.6.
| Vendor | microsoft |
| Product | azure sdk for java |
| Ecosystems | |
| Industries | TechnologyEnterprise |
| Published | May 12, 2026 |
| Last Updated | Jun 19, 2026 |
Stay Ahead of the Next One
Get instant alerts for microsoft azure sdk for java
Be the first to know when new critical vulnerabilities affecting microsoft azure sdk for java are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Microsoft / Azure SDK for Java
1.0.0 < 4.10.6