CVE-2026-33117 Azure SDK for Java Security Feature Bypass Vulnerability
Attackers can bypass integrity verification in the Azure SDK for Java Key Vault Keys library by crafting encrypted input, affecting local cryptographic operations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33117?
CVE-2026-33117 is a critical vulnerability in Microsoft Azure SDK for Java, published on 12 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may bypass integrity verification checks. Operations delegated to the Key Vault service are not affected. The issue is addressed in version 4.10.6.
Which versions are affected by CVE-2026-33117?
2 open source packages ship an affected version, including com.azure:azure-security-keyvault-keys. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.azure:azure-security-keyvault-keys Maven | All versions | 4.10.6 |
com.azure:azure-security-keyvault-keys Maven | All versions | 4.10.6 |
Products include Microsoft Azure Sdk for Java.
How do I fix CVE-2026-33117?
Upgrade com.azure:azure-security-keyvault-keys to 4.10.6 or later.
Is CVE-2026-33117 being exploited?
There is no known exploitation of CVE-2026-33117 in the wild and no public exploit code.
Other vulnerabilities in Microsoft Azure SDK for Java
Sources
Also known as CLEANSTART-2026-DU57513, CLEANSTART-2026-TC96566, CLEANSTART-2026-UN16903, CLEANSTART-2026-XK50947, ECHO-cbaa-8c1b-69db, GHSA-97jf-46m3-8953 and 1 more.