This vulnerability (CVE-2026-33833) in Microsoft Azure Machine Learning is classified as CWE-74, indicating improper neutralization of special elements in output used by a downstream component, which is a form of injection vulnerability. It enables an unauthorized attacker to conduct spoofing attacks over a network. The CVSS 3.1 base score is 8.2, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, high confidentiality impact, low integrity impact, and no availability impact. The vulnerability affects Azure Machine Learning version 3.0.0. Microsoft has released an official fix and, as this is a cloud service, the vendor manages remediation server-side. The vendor advisory is available at the Microsoft Security Response Center.

An attacker exploiting this vulnerability can perform spoofing attacks over a network, potentially leading to unauthorized information disclosure (high confidentiality impact). The integrity impact is low, and availability is not affected. The vulnerability requires user interaction but no privileges, and the attack complexity is low. The scope of the impact extends beyond the vulnerable component.

Microsoft has released an official fix for this vulnerability and manages remediation for Azure Machine Learning as a cloud service. Users should ensure their Azure Machine Learning environment is updated according to Microsoft's guidance in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33833. No additional user action is required beyond applying the official fix or verifying that the cloud service is up to date.