CVE-2026-105014: Azure Pipelines Remote Code Execution Vulnerability

Published Oct 22, 2026

Updated

Azure Pipelines Remote Code Execution Vulnerability

Other sources

Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network.

— Microsoft

Affected Software

2 affected components

Microsoft Azure Pipelines

Event History

Oct 22, 2026

CVE Published

via Microsoft·02:00 PM

Data Sourced

via Microsoft·02:00 PM

DescriptionSeverityWeaknessAffected Software

CVE Published

via MITRE·09:44 PM

Data Sourced

via MITRE·09:44 PM

DescriptionSeverity

Frequently Asked Questions

Does exploitation require authentication or user interaction?

No. The supplied vector indicates that exploitation is network-accessible, requires no privileges, and does not require user interaction.

What impact should responders prioritize if exploitation is suspected?

The issue allows remote code execution through command injection. The severity vector indicates high confidentiality and integrity impact, with no availability impact indicated.

CVE-2026-105014: Azure Pipelines Remote Code Execution Vulnerability

Other sources

Affected Software

Event History

Frequently Asked Questions

Does exploitation require authentication or user interaction?

What impact should responders prioritize if exploitation is suspected?

Company

Resources

Contact

Frequently Asked Questions

Does exploitation require authentication or user interaction?

What impact should responders prioritize if exploitation is suspected?