Skip to content
OpenAdvisories
High MSRC-CVE-2026-33117 1 CVE

Azure SDK for Java Security Feature Bypass Vulnerability

Published May 12, 2026 · Updated May 22, 2026 · Revision 2

Vendor: Microsoft

Summary

Impact: Security Feature Bypass. Microsoft rating: Important. Not known to be exploited — Exploitation Unlikely. Customer action: Required.

Details

What kind of security feature could be bypassed by successfully exploiting this vulnerability?
Successful exploitation of this vulnerability could allow an attacker to bypass the integrity protection provided by the authentication tag that is designed to detect tampering with encrypted data. This may prevent the system from identifying whether encrypted content has been modified before it is decrypted.

How could an attacker exploit this vulnerability?
An attacker could exploit this vulnerability by sending specially crafted encrypted data to an affected application that uses the vulnerable decryption implementation and observing how the application responds. If the application is reachable over a network, this could allow the attacker to manipulate encrypted input in a way that bypasses integrity checks during decryption.

Security updates
4.10.6 — https://github.com/Azure/azure-sdk-for-java/pull/48476

Vulnerabilities 1

Revision history

  1. #2

    The executive summary has been updated to include additional details about this vulnerability. This change does not affect the available security updates. Customers should install the recommended updates to remain protected from this vulnerability.

  2. #1

    Information published.

References