CVE-2026-33107
Published: 03 April 2026
Summary
CVE-2026-33107 is a critical-severity SSRF (CWE-918) vulnerability in Microsoft Azure Databricks. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Validates and sanitizes user-supplied inputs to prevent SSRF exploitation where malicious URLs trigger unauthorized server-side requests leading to privilege elevation.
Monitors and controls communications at system boundaries to block SSRF-induced requests from accessing internal network resources and enabling privilege escalation.
Enforces information flow control policies to restrict unauthorized outbound requests from the vulnerable Azure Databricks server.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SSRF in public-facing Azure Databricks service directly enables remote exploitation of a server application (T1190) and results in privilege escalation within the environment (T1068).
NVD Description
Server-side request forgery (ssrf) in Azure Databricks allows an unauthorized attacker to elevate privileges over a network.
Deeper analysisAI
CVE-2026-33107 is a server-side request forgery (SSRF) vulnerability, mapped to CWE-918, affecting Azure Databricks. Published on 2026-04-03, it has a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), reflecting its critical severity due to network accessibility, low complexity, no required privileges or user interaction, scope change, and high impacts on confidentiality, integrity, and availability.
An unauthorized attacker can exploit this SSRF vulnerability remotely over a network. Exploitation enables the attacker to elevate privileges within the affected Azure Databricks environment.
The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33107 provides details on mitigation and patching guidance.
Details
- CWE(s)