This vulnerability, tracked as CVE-2026-33107 and classified under CWE-918, affects Microsoft Azure Databricks, a cloud-hosted service. It enables an attacker without privileges to perform SSRF attacks that can escalate their privileges across the network. The CVSS 3.1 vector indicates network attack vector, no required privileges or user interaction, and complete impact on confidentiality, integrity, and availability. Microsoft has released an official fix and manages patching for this cloud service. Users should consult the Microsoft advisory for detailed remediation status.

Successful exploitation of this SSRF vulnerability can lead to full compromise of Azure Databricks environments, including unauthorized privilege escalation and potential control over sensitive data and system functions. The impact is critical, affecting confidentiality, integrity, and availability of the service.

Microsoft manages remediation for this cloud-hosted service and has released an official fix. Users should follow the guidance in the Microsoft security update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33107 to ensure their Azure Databricks instances are protected. Since this is a cloud service, the vendor typically applies patches server-side, so customers should verify their environment's update status per Microsoft’s advisory.