CVE-2026-109467 Azure DevOps Server Remote Code Execution Vulnerability
CriticalCVSS 9.9
EPSS 0.73%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Improper authentication in Azure DevOps allows an authorized attacker to execute code over a network.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft azure devops | All versions | No fix listed |
| Microsoft azure devops server 2025 | < Patch 9 | Patch 9 |
| Microsoft azure devops | >= 1.0.0, < publication | publication |
| Microsoft azure devops server 2025 | >= 1.0.0.0, < Patch 9 | Patch 9 |
References
- MSRC Security Update Guide patch vendor-advisory
- Release Notes patch
- Release Notes vendor-advisory