1. Home
  2. CVE Database
  3. CVE-2026-33117
CRITICAL · 9.1

CVE-2026-33117

The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected ap...

Vulnerability Description

The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may bypass integrity verification checks. Operations delegated to the Key Vault service are not affected. The issue is addressed in version 4.10.6.

CVSS Score

9.1

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
NONE

Affected Products

VendorProductVersions
MicrosoftAzure Sdk For Java< 4.10.6

Related Weaknesses (CWE)

CWE-287CWE-347

References

FAQ

What is CVE-2026-33117?

CVE-2026-33117 is a vulnerability with a CVSS score of 9.1 (CRITICAL). The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected ap...

How severe is CVE-2026-33117?

CVE-2026-33117 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2026-33117?

Check the references section above for vendor advisories and patch information. Affected products include: Microsoft Azure Sdk For Java.