CVE-2026-119989: Azure Pipelines Remote Code Execution Vulnerability
CVE-2026-119989 is a remote code execution vulnerability in Azure Pipelines, rated Important by Microsoft, with a CVSS 3.1 base score of 8.2 (High). An attacker can exploit it remotely over the network, with low privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. Microsoft released the fix on 10 November 2026 in the November 2026 Patch Tuesday. It affects 1 product in 1 product family (Azure).
Key facts
- CVE ID
- CVE-2026-119989
- Severity
- High CVSS 8.2
- Microsoft severity
- Important
- Impact
- Remote Code Execution
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- Less Likely
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- November 2026 Patch Tuesday
- Product families
- Azure
CVSS score and vector
Microsoft scores CVE-2026-119989 at 8.2 (temporal 7.1) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Network |
| Attack complexity | High |
| Privileges required | Low |
| User interaction | None |
| Scope | Changed |
| Confidentiality impact | High |
| Integrity impact | High |
| Availability impact | None |
| Exploit code maturity | Unproven |
| Remediation level | Official fix |
| Report confidence | Confirmed |
Description
Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an authorized attacker to execute code over a network.
Frequently asked questions (Microsoft)
According to the CVSS metric, the attack complexity is high (AC:H). What does this mean for this vulnerability?
An attacker would need specific conditions to be in place (i.e. particular protocol settings, or configurations, etc.) before an attack could succeed, which reduces the likelihood of widespread or opportunistic exploitation.
How could an attacker exploit this vulnerability?
An authenticated contributor could place specially crafted content in application files processed by an existing Azure Pipelines build. Under specific pipeline configurations, successful exploitation could allow the attacker to execute code as the pipeline agent account. Additional user interaction is not required when the pipeline runs automatically.
Affected products (1)
Azure
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Azure Web Apps | Release Notes | Security Update | 2.10.0 | No |
Acknowledgments
- Dohyeok Kim
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. |