CVE-2026-112745: Azure DevOps Server Information Disclosure Vulnerability

Published Nov 10, 2026

Updated

Azure DevOps Server Information Disclosure Vulnerability

Other sources

Server-side request forgery (ssrf) in Azure DevOps Server allows an authorized attacker to disclose information over a network.

— Microsoft

Affected Software

1 affected component

Microsoft Azure DevOps Server

Event History

Nov 10, 2026

CVE Published

via Microsoft·04:00 PM

Data Sourced

via Microsoft·04:00 PM

DescriptionSeverityWeakness

CVE Published

via MITRE·06:21 PM

Data Sourced

via MITRE·06:21 PM

DescriptionSeverity

Data Sourced

via NVD·07:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The attacker must already be authorized to access Azure DevOps Server. Exploitation can be performed over the network and does not require user interaction.

What is the security impact if exploitation succeeds?

Successful exploitation may allow disclosure of information. The available data does not indicate an integrity or availability impact.

CVE-2026-112745: Azure DevOps Server Information Disclosure Vulnerability

Other sources

Affected Software

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the security impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the security impact if exploitation succeeds?