CVE-2026-112745: Azure DevOps Server Information Disclosure Vulnerability

CVE-2026-112745 is an information disclosure vulnerability in Azure DevOps Server, rated Important by Microsoft, with a CVSS 3.1 base score of 6.5 (Medium). An attacker can exploit it remotely over the network, with low privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as more likely. Microsoft released the fix on 10 November 2026 in the November 2026 Patch Tuesday. It affects 2 products in 1 product family (Developer Tools).

Key facts

CVE ID: CVE-2026-112745
Severity: Medium CVSS 6.5
Microsoft severity: Important
Impact: Information Disclosure
Exploited in the wild: No
Publicly disclosed: No
Exploitation likelihood: More Likely
CISA KEV: Not listed
Released: 10 November 2026
Last updated: 10 November 2026
Patch Tuesday: November 2026 Patch Tuesday
Product families: Developer Tools

CVSS score and vector

Microsoft scores CVE-2026-112745 at 6.5 (temporal 5.7) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C

Metric	Value
Attack vector	Network
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality impact	High
Integrity impact	None
Availability impact	None
Exploit code maturity	Unproven
Remediation level	Official fix
Report confidence	Confirmed

Description

Server-side request forgery (ssrf) in Azure DevOps Server allows an authorized attacker to disclose information over a network.

Frequently asked questions (Microsoft)

What type of information could be disclosed by this vulnerability?

Exploiting this vulnerability could allow the disclosure of credentials.

Affected products (2)

Developer Tools

Product	Security update	Type	Fixed build	Restart
Azure DevOps Server	Release Notes	Security Update	Patch 8	Maybe
Azure DevOps	Release Notes	Security Update	Sprint 278	No

Acknowledgments

Revision history

Version	Date	Description
1.0	10 November 2026	Information published.