CVE-2026-85923: Azure DevOps Server Elevation of Privilege Vulnerability

Published Nov 10, 2026

Updated

Authorization bypass through user-controlled key in Azure DevOps Server allows an authorized attacker to elevate privileges over a network.

Other sources

Azure DevOps Server Elevation of Privilege Vulnerability

— Microsoft

Affected Software

1 affected component

Microsoft Azure DevOps Server

Event History

Nov 10, 2026

CVE Published

via Microsoft·04:00 PM

Data Sourced

via Microsoft·04:00 PM

DescriptionSeverityWeakness

CVE Published

via MITRE·06:16 PM

Data Sourced

via MITRE·06:16 PM

DescriptionSeverity

Data Sourced

via NVD·07:21 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

An attacker must already be authorized in Azure DevOps Server. Exploitation can be performed over the network and does not require user interaction.

What level of access could an attacker gain?

The vulnerability allows an authorized attacker to elevate privileges. The provided severity metrics indicate potential high impact to confidentiality, integrity, and availability.

Is there a documented workaround or affected version list?

The provided information does not include affected versions, fixed versions, or mitigation steps. Review the Microsoft security advisory referenced for product-specific remediation guidance.

CVE-2026-85923: Azure DevOps Server Elevation of Privilege Vulnerability

Other sources

Affected Software

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

What level of access could an attacker gain?

Is there a documented workaround or affected version list?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

What level of access could an attacker gain?

Is there a documented workaround or affected version list?