CVE-2026-33117: CWE-287: Improper Authentication in Microsoft Azure SDK for Java
The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may bypass integrity verification checks. Operations delegated to the Key Vault service are not affected. The issue is addressed in version 4.10.6.
AI Analysis
Technical Summary
The vulnerability CVE-2026-33117 affects the Java Key Vault Keys library within the Azure SDK for Java. The root cause is an incorrect implementation of the authentication tag comparison in the local cryptographic verification path, which is part of the client-side cryptography. This defect can allow attackers to bypass integrity verification by submitting specially crafted encrypted inputs. The vulnerability does not affect operations delegated to the Azure Key Vault service, which remain secure. Microsoft has addressed this issue with an official fix in version 4.10.6 of the SDK. The CVSS v3.1 score is 9.1, indicating a critical severity with network attack vector, no privileges required, and high impact on confidentiality and integrity.
Potential Impact
Successful exploitation of this vulnerability can lead to bypassing integrity verification checks in applications using the vulnerable local cryptography path, potentially compromising data confidentiality and integrity. However, operations that rely on the Azure Key Vault service itself are not affected. There are no known exploits in the wild at this time.
Mitigation Recommendations
An official fix is available in version 4.10.6 of the Azure SDK for Java. Users should upgrade to this version or later to remediate the vulnerability. Since this is a cloud service SDK, Microsoft manages the security of the Azure Key Vault service itself, which is not impacted. No additional mitigation steps are indicated by the vendor advisory.
CVE-2026-33117: CWE-287: Improper Authentication in Microsoft Azure SDK for Java
Description
The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may bypass integrity verification checks. Operations delegated to the Key Vault service are not affected. The issue is addressed in version 4.10.6.
CVSS v3.1
Score 9.1critical
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-33117 affects the Java Key Vault Keys library within the Azure SDK for Java. The root cause is an incorrect implementation of the authentication tag comparison in the local cryptographic verification path, which is part of the client-side cryptography. This defect can allow attackers to bypass integrity verification by submitting specially crafted encrypted inputs. The vulnerability does not affect operations delegated to the Azure Key Vault service, which remain secure. Microsoft has addressed this issue with an official fix in version 4.10.6 of the SDK. The CVSS v3.1 score is 9.1, indicating a critical severity with network attack vector, no privileges required, and high impact on confidentiality and integrity.
Potential Impact
Successful exploitation of this vulnerability can lead to bypassing integrity verification checks in applications using the vulnerable local cryptography path, potentially compromising data confidentiality and integrity. However, operations that rely on the Azure Key Vault service itself are not affected. There are no known exploits in the wild at this time.
Mitigation Recommendations
An official fix is available in version 4.10.6 of the Azure SDK for Java. Users should upgrade to this version or later to remediate the vulnerability. Since this is a cloud service SDK, Microsoft manages the security of the Azure Key Vault service itself, which is not impacted. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- microsoft
- Date Reserved
- 2026-03-17T20:15:23.721Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- official-fix
- Is Cloud Service
- true
- Vendor Advisory Urls
- [{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33117","vendor":"Microsoft"}]
Threat ID: 6a036539cbff5d861008c32b
Added to database: 05/12/2026, 17:36:57 UTC
Last enriched: 08/11/2026, 16:33:17 UTC
Last updated: 08/19/2026, 22:52:11 UTC
Views: 164
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.