CVE-2026-109467: Azure DevOps Server Remote Code Execution Vulnerability

Published Nov 10, 2026

Updated

Azure DevOps Server Remote Code Execution Vulnerability

Other sources

Improper authentication in Azure DevOps allows an authorized attacker to execute code over a network.

— Microsoft

Affected Software

1 affected component

Microsoft Azure DevOps

Event History

Nov 10, 2026

CVE Published

via Microsoft·04:00 PM

Data Sourced

via Microsoft·04:00 PM

DescriptionSeverityWeakness

Data Sourced

via Microsoft·04:00 PM

Affected Software

CVE Published

via MITRE·06:15 PM

Data Sourced

via MITRE·06:15 PM

DescriptionSeverity

Data Sourced

via NVD·07:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this vulnerability?

Azure DevOps Server deployments are exposed. Exploitation requires an authorized attacker with valid access to the affected server and network connectivity to it.

Does exploitation require user interaction or a complex attack?

No user interaction is required. The supplied vector indicates low attack complexity and network-based exploitation.

What impact could successful exploitation have?

A successful attacker may execute code and could have high impact on confidentiality and integrity, with low impact on availability. The scope is rated as changed.

CVE-2026-109467: Azure DevOps Server Remote Code Execution Vulnerability

Other sources

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this vulnerability?

Does exploitation require user interaction or a complex attack?

What impact could successful exploitation have?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this vulnerability?

Does exploitation require user interaction or a complex attack?

What impact could successful exploitation have?