CVE-2026-68791 is an incorrect authorization vulnerability (CWE-863) in Microsoft Azure Machine Learning that permits unauthorized attackers to disclose information over a network. The CVSS v3.1 base score is 8.6, reflecting a high severity with network attack vector, low attack complexity, no privileges or user interaction required, and a scope change. Microsoft has issued an official fix and manages remediation for this cloud service. No known active exploitation has been reported.

An attacker without any privileges or user interaction can exploit this vulnerability remotely to disclose sensitive information from Azure Machine Learning. The impact is confidentiality loss without affecting integrity or availability. The scope is changed, meaning the vulnerability affects resources beyond the initially vulnerable component.

Microsoft has released an official fix for this vulnerability and manages remediation for Azure Machine Learning as a cloud service. Users should ensure their Azure Machine Learning instances are updated according to Microsoft's guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68791. No additional user action is required beyond applying the official fix.