CVE-2026-33117criticalCWE-287CWE-347

CVE-2026-33117: fallo crítico en Microsoft Azure SDK for Java

Azure SDK for Java Security Feature Bypass Vulnerability

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Azure SDK for Java+ Monitorear com.azure:azure-security-keyvault-keys

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.1epss 0.5%
The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may bypass integrity verification checks. Operations delegated to the Key Vault service are not affected. The issue is addressed in version 4.10.6.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
Productos afectados
Microsoft · Azure SDK for Java
CVEs relacionadas — Microsoft Azure SDK for Java

En el mismo producto, de las más peligrosas a las menos.

CVE-2020-16971HIGHAzure SDK for Java Security Feature Bypass VulnerabilityEPSS 4.3%