EUVD-2026-29580
GHSA-mq64-7vwv-8j4j
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Network-reachable unauthenticated injection (AV:N/PR:N/AC:L) that needs a victim to render output (UI:R) and crosses a trust boundary (S:C); impact is disclosure/deception (C:H, I:L, A:N).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Machine Learning allows an unauthorized attacker to perform spoofing over a network.
AnalysisAI
Spoofing in Microsoft Azure Machine Learning (versions 3.0.0 up to but not including 1.7.6) lets an unauthenticated network attacker inject improperly neutralized special elements into output rendered by a downstream component, enabling them to impersonate trusted content or identities against a victim who interacts with the malicious output. The CVSS 3.1 base score is 8.2 with a scope change and high confidentiality impact, but real-world urgency is tempered by an EPSS of just 0.05% (15th percentile) and CISA SSVC rating exploitation as 'none'. There is no public exploit identified at time of analysis and the issue is not on the CISA KEV list.
Technical ContextAI
Azure Machine Learning is Microsoft's cloud-hosted platform for building, training, and deploying machine-learning models, exposed through the Azure portal, ML Studio web interface, and REST/SDK endpoints. The root cause is CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, i.e. injection): user-influenced data is passed to a downstream renderer or interpreter without adequate escaping, so crafted special characters are treated as active markup or control elements rather than inert text. Because the vulnerable service processes attacker-supplied input and emits it into a context (such as a browser or another service component) trusted by the victim, the flaw manifests as spoofing. The scope-change flag (S:C) in the CVSS vector indicates the injected content crosses a trust/authority boundary, affecting resources beyond the component that mishandled the input. The single CPE affected is cpe:2.3:a:microsoft:azure_machine_learning:*:*:*:*:*:*:*:*.
RemediationAI
Apply the vendor fix: Vendor-released patch is available in Azure Machine Learning version 1.7.6, so ensure the platform, SDK, and any self-managed components are updated to 1.7.6 or later per Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33833. Because Azure Machine Learning is a Microsoft-hosted cloud service, much of the remediation is applied server-side by Microsoft; customers should still upgrade any pinned SDK/CLI versions and confirm their workspace runtime is current. As interim compensating controls until updates propagate, restrict who can submit or share content that other users render in ML Studio, avoid opening ML Studio links or artifacts from untrusted sources (which neutralizes the required user-interaction step), and review workspace RBAC to limit exposure of shared assets; the trade-off is reduced collaboration convenience. Consult the VulDB entry (https://vuldb.com/vuln/363129) and NVD record (https://nvd.nist.gov/vuln/detail/CVE-2026-33833) for tracking.
More in Azure Machine Learning
View allImproper authorization in Azure allows an authorized attacker to elevate privileges over a network. Rated critical sever
Azure Machine Learning Compute Instance Information Disclosure Vulnerability. Rated medium severity (CVSS 6.5), this vul
Azure Machine Learning Information Disclosure Vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is no
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today