Microsoft Azure Machine Learning vulnerabilities

9 CVEs affecting Microsoft Azure Machine Learning, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-68791, published 2026-09-17.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-23382, published 2023-02-14. Medium severity, CVSS 6.5. EPSS: 2.7% chance of exploitation in the next 30 days. Azure Machine Learning Compute Instance Information Disclosure Vulnerability
• CVE-2023-28312, published 2023-04-11. Medium severity, CVSS 6.5. EPSS: 1.5% chance of exploitation in the next 30 days. Azure Machine Learning Information Disclosure Vulnerability
• CVE-2025-30390, published 2025-04-30. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. Improper authorization in Azure allows an authorized attacker to elevate privileges over a network.
• CVE-2025-49746, published 2025-07-18. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. Improper authorization in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.
• CVE-2025-49747, published 2025-07-18. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. Missing authorization in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.
• CVE-2025-47995, published 2025-07-18. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. Weak authentication in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.
• CVE-2026-32207, published 2026-05-07. Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days. Improper neutralization of input during web page generation ('cross-site scripting') in Azure Machine Learning allows an unauthorized attacker to perform spoofing over a network.
• CVE-2026-33833, published 2026-05-12. High severity, CVSS 8.2. EPSS: 0.5% chance of exploitation in the next 30 days. Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Machine Learning allows an unauthorized attacker to perform spoofing over a network.
• CVE-2026-68791, published 2026-09-17. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose information over a network.