Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

msrc логотип

CVE-2026-33117

Опубликовано: 22 мая 2026
Источник: msrc
CVSS3: 9.1
EPSS Низкий

Описание

Azure SDK for Java Security Feature Bypass Vulnerability

The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may bypass integrity verification checks. Operations delegated to the Key Vault service are not affected. The issue is addressed in version 4.10.6.

FAQ

What kind of security feature could be bypassed by successfully exploiting this vulnerability?

Successful exploitation of this vulnerability could allow an attacker to bypass the integrity protection provided by the authentication tag that is designed to detect tampering with encrypted data. This may prevent the system from identifying whether encrypted content has been modified before it is decrypted.

How could an attacker exploit this vulnerability?

An attacker could exploit this vulnerability by sending specially crafted encrypted data to an affected application that uses the vulnerable decryption implementation and observing how the application responds. If the application is reachable over a network, this could allow the attacker to manipulate encrypted input in a way that bypasses integrity checks during decryption.

Обновления

ПродуктСтатьяОбновление
Azure SDK for Java

Показывать по

Возможность эксплуатации

Publicly Disclosed

No

Exploited

No

Latest Software Release

Exploitation Unlikely

EPSS

Процентиль: 39%
0.00479
Низкий

9.1 Critical

CVSS3

Связанные уязвимости

CVSS3: 9.1
nvd
3 месяца назад

The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may bypass integrity verification checks. Operations delegated to the Key Vault service are not affected. The issue is addressed in version 4.10.6.

CVSS3: 9.1
github
3 месяца назад

Security feature bypass vulnerability in Azure Key Vault Keys library for Java

CVSS3: 9.1
fstec
3 месяца назад

Уязвимость программного пакета для разработки программного обеспечения Azure SDK for Java, связанная с недостатками процедуры аутентификации, позволяющая нарушителю обойти ограничения безопасности

EPSS

Процентиль: 39%
0.00479
Низкий

9.1 Critical

CVSS3