Read the docs
TI-2026-25549 Aliases CVE-2026-33117GHSA-97jf-46m3-8953

Azure SDK for Java Security Feature Bypass Vulnerability

Priority MEDIUM 48CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from Microsoft.

Summary

The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may bypass integrity verification checks. Operations delegated to the Key Vault service are not affected. The issue is addressed in version 4.10.6.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0048 41st percentileScored 2026-11-07
Fix Fixed Azure SDK for Java (Microsoft): 4.10.6com.azure:azure-security-keyvault-keys (Maven): 4.10.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftAzure SDK for Java1.0.0 to before 4.10.64.10.6Patch availableCNA
—com.azure:azure-security-keyvault-keys (Maven)before 4.10.64.10.6Patch availableGHSA-97jf-46m3-8953
  • Azure SDK for Java VendorMicrosoft Affected 1.0.0 to before 4.10.6 Fixed in 4.10.6 Patch available CNA
  • com.azure:azure-security-keyvault-keys (Maven) Vendor— Affected before 4.10.6 Fixed in 4.10.6 Patch available GHSA-97jf-46m3-8953

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:azure_sdk_for_java:*:*:*:*:*:*:*:*before 4.10.6VulnerableMicrosoft
  • cpe:2.3:a:microsoft:azure_sdk_for_java:*:*:*:*:*:*:*:* Versions before 4.10.6 Vulnerable ·Microsoft

Remediation

  • Fix · CNA Azure SDK for Java (Microsoft) Fixed in 4.10.6
  • Fix · GHSA-97jf-46m3-8953 com.azure:azure-security-keyvault-keys (Maven) Fixed in 4.10.6 Advisory →

Vendor assessments

Microsoft

Microsoft's page for this CVE →

Impact
Security Feature Bypass
Exploited
No
Publicly disclosed
No
Exploitability
Exploitation Unlikely
ProductStatusPlan or fix
Azure SDK for JavaFixed 4.10.6 · Security Update

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33117
  2. 2026-10-03 Alias added: GHSA-97jf-46m3-8953

References

Patch 1

Advisory 1

Other 3

  • TI-2020-12957 Azure SDK for Java Security Feature Bypass Vulnerability CVSS 3.1CRITICAL 9.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences