CVE-2026-33117

critical

Published 2026-05-12 · Modified 2026-05-22

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

9.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CVSS v4 NEW

—

not yet in upstream

VIR risk

9.1

Description

<p>The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may bypass integrity verification checks. Operations delegated to the Key Vault service are not affected. The issue is addressed in version 4.10.6.</p>

Predictions

Exploit likelihood

94%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

OS impact

OS	Version	Status	Fixed in
windows		affected

Application impact

Vendor	Product	Versions	Fixed
microsoft	azure_sdk_for_java	`{"endExcluding":"4.10.6"}`	`4.10.6`
microsoft	azure

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33117

CWEs

CWE-287 CWE-347

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.