6.5 Medium

CVE-2025-47995 Azure Machine Learning Elevation of Privilege Vulnerability

Description

Weak authentication in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 detail

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C

Exploitable remotely over the network, with an ordinary account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Network
Attack complexity: Low
Privileges required: Low
Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

Affected products and versions

Product	Affected versions	Fixed in
Azure Machine Learning	Versions not published

References

Azure Machine Learning Elevation of Privilege Vulnerability msrc.microsoft.com

Timeline

Published July 18, 2025
Last modified November 3, 2026

The 10 CVEs of Azure Machine Learning →

CVE-2026-68791 Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose information over a network 8.6 High CVE-2026-33833 Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Machine… 8.2 High CVE-2026-32207 Improper neutralization of input during web page generation ('cross-site scripting') in Azure Machine Learning allows an… 8.8 High CVE-2025-49746 Improper authorization in Azure Machine Learning allows an authorized attacker to elevate privileges over a network 9.9 Critical

Track this CVE