Improper neutralization of user input during web page generation in Azure Machine Learning results in a cross‑site scripting vulnerability that can be leveraged by an unauthorized attacker to perform spoofing over a network. The flaw allows malicious scripts to be injected into notebooks, potentially masquerading the identity of the notebook or the portal and tricking users into interacting with forged content. This can lead to disclosure of sensitive information and unauthorized actions within the Azure environment.

Microsoft Azure Machine Learning components are affected. No specific patch version is listed in the advisory, so all deployments of Azure Machine Learning that have not applied the vendor’s fix for CVE‑2026‑32207 remain vulnerable.

The CVSS score of 8.8 indicates a high severity vulnerability. While an EPSS score is not available, the lack of a KEV listing suggests that no large‑scale exploitation is currently documented. The likely attack vector involves injecting malicious script payloads into a notebook that is later viewed or executed by a target user. If successful, the attacker can spoof the notebook’s origin and potentially steal credentials or manipulate computations.