CVE-2026-32207

Awaiting Analysis Awaiting Analysis - Queue

Cross-Site Scripting in Azure Machine Learning

Publication date: 2026-05-07

Last updated on: 2026-05-08

Assigner: Microsoft Corporation

Description

Improper neutralization of input during web page generation ('cross-site scripting') in Azure Machine Learning allows an unauthorized attacker to perform spoofing over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-07

Last Modified

2026-05-08

Generated

2026-07-09

AI Q&A

2026-05-08

EPSS Evaluated

2026-07-08

NVD

CVE-2026-32207

EUVD

EUVD-2026-28447

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	azure_machine_learning	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a cross-site scripting (XSS) issue in Azure Machine Learning. It occurs because the system does not properly neutralize input during web page generation, allowing an unauthorized attacker to inject malicious scripts.

As a result, the attacker can perform spoofing attacks over a network, potentially tricking users or systems by presenting false information.

Impact Analysis

This vulnerability can have severe impacts including unauthorized access and control over user interactions due to spoofing.

Confidentiality can be compromised (C:H) as attackers may steal sensitive information.
Integrity can be compromised (I:H) as attackers may alter data or content.
Availability can be compromised (A:H) as attackers may disrupt services.

Hi! I’m here to help you understand CVE-2026-32207. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70