Improper neutralization of special elements in output used by a downstream component in Azure Machine Learning enables an unauthorized attacker to perform spoofing over a network, potentially allowing the attacker to impersonate legitimate traffic and manipulate or intercept communications. The weakness is an injection type vulnerability that fails to sanitize output, giving an attacker a pathway to substitute or fake data in transit.

Microsoft Azure Machine Learning services are affected, though specific product versions are not listed in the advisory. All deployments that expose notebooks or downstream components without proper output filtering could be vulnerable.

The vulnerability carries a CVSS score of 8.2, indicating high severity. The EPSS score is not available, but the absence of a KEV listing suggests no publicly known exploitation as of now. The likely attack vector is remote injection via unsanitized data rendered in notebooks, requiring network access to the Azure Machine Learning portal or services. The impact is limited to spoofing rather than full code execution, yet it can enable attackers to impersonate legitimate traffic and potentially facilitate further attacks.