This vulnerability, identified as CWE-79, is due to improper neutralization of input during web page generation in Microsoft Azure Machine Learning. It enables an attacker without privileges to conduct spoofing attacks by injecting malicious scripts. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. Microsoft has released an official fix and manages patching for this cloud-hosted service.

Successful exploitation could lead to high impact on confidentiality, integrity, and availability of the affected system by allowing an attacker to execute arbitrary scripts in the context of the victim's browser, leading to spoofing and potential further attacks. However, no known exploits are reported in the wild at this time.

Microsoft has provided an official fix for this vulnerability and manages remediation for Azure Machine Learning as a cloud service. Users should ensure their Azure Machine Learning instances are updated according to Microsoft's guidance available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32207. No additional user action is typically required beyond applying the official updates.