CVE-2026-33117

9.1 Critique

Publiée le 12/05/2026 à 20:17 · Modifiée le 17/06/2026 à 12:36 · Modifiée · Source : secure@microsoft.com

Description

The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may bypass integrity verification checks. Operations delegated to the Key Vault service are not affected. The issue is addressed in version 4.10.6.

Traduire en français

Produits concernés

Microsoft Azure SDK for Java

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.1 Critique	secure@microsoft.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`

Faiblesses (CWE)

CWE-287
CWE-347

Références

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33117 Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories