CVE-2026-109467: Azure DevOps Server Remote Code Execution Vulnerability
CVE-2026-109467 is a remote code execution vulnerability in Azure DevOps Server, rated Important by Microsoft, with a CVSS 3.1 base score of 9.9 (Critical). An attacker can exploit it remotely over the network, with low privileges and without user interaction. Microsoft has not reported exploitation in the wild. Microsoft released the fix on 10 November 2026 in the November 2026 Patch Tuesday. It affects 2 products in 1 product family (Developer Tools).
Key facts
- CVE ID
- CVE-2026-109467
- Severity
- Critical CVSS 9.9
- Microsoft severity
- Important
- Impact
- Remote Code Execution
- Exploited in the wild
- No
- Publicly disclosed
- No
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- November 2026 Patch Tuesday
- Product families
- Developer Tools
CVSS score and vector
Microsoft scores CVE-2026-109467 at 9.9 (temporal 8.6) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L/E:U/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Scope | Changed |
| Confidentiality impact | High |
| Integrity impact | High |
| Availability impact | Low |
| Exploit code maturity | Unproven |
| Remediation level | Official fix |
| Report confidence | Confirmed |
Description
Improper authentication in Azure DevOps allows an authorized attacker to execute code over a network.
Frequently asked questions (Microsoft)
How could an attacker exploit this vulnerability?
An attacker with Project Reader access to an affected Azure DevOps organization could send a specially crafted network request to trigger unauthorized pipeline execution. Successful exploitation could allow the attacker to execute code on pipeline agents. No additional user interaction is required.
Affected products (2)
Developer Tools
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Azure DevOps | Release Notes | Security Update | No | |
| Azure DevOps Server 2025 | Release Notes | Security Update | Patch 9 | No |
Acknowledgments
- Bui Xuan Quang (buxu) with Ncsgroup.vn
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. |