CVE-2026-120783: Azure DevOps Server Elevation of Privilege Vulnerability

Q: Who is exposed to this vulnerability?

Organizations using Microsoft Azure DevOps Server 2025 are affected according to the available software information. Exploitation requires an authorized attacker with existing access.

Q: Can an unauthenticated internet attacker exploit this issue?

The available vector indicates network attack access but also requires low privileges. The description identifies the attacker as authorized, so unauthenticated exploitation is not indicated.

Q: What level of access could an attacker gain?

An authorized attacker may elevate privileges. The provided severity vector indicates high confidentiality impact and low integrity and availability impact.

Published Nov 10, 2026

Updated

Azure DevOps Server Elevation of Privilege Vulnerability

Other sources

Weak authentication in Azure DevOps Server allows an authorized attacker to elevate privileges over a network.

— Microsoft

Affected Software

1 affected componentFixes available

Microsoft Azure DevOps Server 2025<20260304.1

20260304.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20260304.1

Event History

Nov 10, 2026

CVE Published

via Microsoft·04:00 PM

Data Sourced

via Microsoft·04:00 PM

DescriptionSeverityWeakness

Data Sourced

via Microsoft·04:00 PM

Affected Software

CVE Published

via MITRE·06:22 PM

Data Sourced

via MITRE·06:22 PM

DescriptionSeverity

Data Sourced

via NVD·07:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this vulnerability?

Organizations using Microsoft Azure DevOps Server 2025 are affected according to the available software information. Exploitation requires an authorized attacker with existing access.

Can an unauthenticated internet attacker exploit this issue?

The available vector indicates network attack access but also requires low privileges. The description identifies the attacker as authorized, so unauthenticated exploitation is not indicated.

What level of access could an attacker gain?

An authorized attacker may elevate privileges. The provided severity vector indicates high confidentiality impact and low integrity and availability impact.

CVE-2026-120783: Azure DevOps Server Elevation of Privilege Vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this vulnerability?

Can an unauthenticated internet attacker exploit this issue?

What level of access could an attacker gain?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this vulnerability?

Can an unauthenticated internet attacker exploit this issue?

What level of access could an attacker gain?