PT-2026-38576 · Microsoft · Azure Machine Learning

Jianyang Song · Published 2026-05-07 · Updated 2026-05-12 · CVE-2026-32207

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Azure Machine Learning (affected versions not specified)

Description Improper neutralization of input during web page generation in Azure Machine Learning allows an unauthorized attacker to perform spoofing over a network. This issue is a form of cross-site scripting (XSS), which occurs when an application includes untrusted data in a web page without proper validation or encoding.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-06465

CVE-2026-32207

Affected Products

Azure Machine Learning

References · 9

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32207 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32207 · Security Note
• https://bdu.fstec.ru/vul/2026-06465 · Security Note
• https://twitter.com/SelvaKtm2/status/2053146358417432657 · Twitter Post
• https://twitter.com/cybrsecpath/status/2053428508488323371 · Twitter Post
• https://feedly.com/cve/CVE-2026-32207 · Note
• https://twitter.com/CVEnew/status/2053559200677044275 · Twitter Post
• https://twitter.com/infoflowcloud/status/2053560054071079333 · Twitter Post
• https://twitter.com/VigneshVic23698/status/2054071632663330910 · Twitter Post