This vulnerability (CVE-2026-33833) in Microsoft Azure Machine Learning is categorized under CWE-74, indicating improper neutralization of special elements in output used by a downstream component, which constitutes an injection flaw. This weakness enables an unauthorized attacker to conduct spoofing attacks over a network. The CVSS 3.1 base score is 8.2, reflecting high severity with network attack vector, low attack complexity, no privileges required, and user interaction required. The scope is changed, with high confidentiality impact, low integrity impact, and no availability impact. Microsoft has published an official fix and manages remediation for this cloud-hosted service. No known exploits are reported in the wild.

An attacker exploiting this vulnerability can perform spoofing over a network, potentially compromising confidentiality of data processed or transmitted by Azure Machine Learning. The integrity impact is low, and availability is not affected. The vulnerability requires user interaction but no privileges, and can be exploited remotely over the network.

Microsoft has released an official fix for this vulnerability and manages remediation for Azure Machine Learning as a cloud service. Users should verify that their Azure Machine Learning instances are updated according to Microsoft's guidance available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33833. No additional user action beyond applying the official fix is required.