CVE-2026-119989: Azure Pipelines Remote Code Execution Vulnerability

Q: What level of access does an attacker need to exploit this issue?

The attacker must be authorized and have low privileges. Exploitation can be performed over a network and does not require user interaction.

Q: How difficult is exploitation?

The supplied vector rates attack complexity as high, meaning exploitation requires conditions beyond ordinary network reachability and low-privileged authorization.

Q: What is the potential impact if exploitation succeeds?

Successful exploitation can result in remote code execution, with high confidentiality and integrity impact. The scope may extend beyond the initially affected security authority, while availability impact is rated none.

Published Nov 10, 2026

Updated

Azure Pipelines Remote Code Execution Vulnerability

Other sources

Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an authorized attacker to execute code over a network.

— Microsoft

Affected Software

1 affected componentFixes available

Microsoft Azure Web Apps<2.10.0

2.10.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.10.0

Event History

Nov 10, 2026

CVE Published

via Microsoft·04:00 PM

Data Sourced

via Microsoft·04:00 PM

DescriptionSeverityWeakness

Data Sourced

via Microsoft·04:00 PM

Affected Software

CVE Published

via MITRE·06:23 PM

Data Sourced

via MITRE·06:23 PM

DescriptionSeverity

Data Sourced

via NVD·07:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The attacker must be authorized and have low privileges. Exploitation can be performed over a network and does not require user interaction.

How difficult is exploitation?

The supplied vector rates attack complexity as high, meaning exploitation requires conditions beyond ordinary network reachability and low-privileged authorization.

What is the potential impact if exploitation succeeds?

Successful exploitation can result in remote code execution, with high confidentiality and integrity impact. The scope may extend beyond the initially affected security authority, while availability impact is rated none.

CVE-2026-119989: Azure Pipelines Remote Code Execution Vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

How difficult is exploitation?

What is the potential impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

How difficult is exploitation?

What is the potential impact if exploitation succeeds?