This vulnerability (CVE-2026-33833) in Microsoft Azure Machine Learning (version 3.0.0) is classified under CWE-74, indicating improper neutralization of special elements in output used by a downstream component, resulting in injection. The flaw enables an attacker without privileges to perform spoofing attacks over a network. The CVSS v3.1 base score is 8.2 (high), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, high confidentiality impact, low integrity impact, and no availability impact. Microsoft has released an official fix and manages remediation for this cloud-hosted service. The vendor advisory is available at the Microsoft Security Response Center.

An attacker can exploit this vulnerability to spoof network communications, potentially misleading users or systems relying on Azure Machine Learning outputs. The confidentiality impact is high, indicating possible unauthorized disclosure of information. Integrity impact is low, and availability is not affected. No known exploits have been reported in the wild.

Microsoft has provided an official fix for this vulnerability. As Azure Machine Learning is a cloud service, Microsoft manages the remediation server-side. Users should verify that their Azure Machine Learning instances are updated according to the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33833 to ensure protection. No additional user action is required beyond applying the official fix.