CVE-2026-33117

Katalog CVE

CVSS 9.1 · Critical EPSS 0,50%

Kerentanan Improper Authentication pada microsoft azure sdk for java. Skor CVSS 3.1 9.1 (Critical) menurut microsoft.com.

Deskripsi (NVD)

The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may bypass integrity verification checks. Operations delegated to the Key Vault service are not affected. The issue is addressed in version 4.10.6.

Rincian

Terbit di NVD

12 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber microsoft.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication
CWE-347: Improper Verification of Cryptographic Signature

EPSS (30 hari)

0,50% peluang dieksploitasi; lebih tinggi dari 40,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33117 advisory vendor