CVE-2026-120783: Azure DevOps Server Elevation of Privilege Vulnerability
CVE-2026-120783 is an elevation of privilege vulnerability in Azure DevOps Server, rated Important by Microsoft, with a CVSS 3.1 base score of 6.4 (Medium). An attacker can exploit it remotely over the network, with low privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. Microsoft released the fix on 10 November 2026 in the November 2026 Patch Tuesday. It affects 1 product in 1 product family (Developer Tools).
Key facts
- CVE ID
- CVE-2026-120783
- Severity
- Medium CVSS 6.4
- Microsoft severity
- Important
- Impact
- Elevation of Privilege
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- Less Likely
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- November 2026 Patch Tuesday
- Product families
- Developer Tools
CVSS score and vector
Microsoft scores CVE-2026-120783 at 6.4 (temporal 5.8) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Network |
| Attack complexity | High |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality impact | High |
| Integrity impact | Low |
| Availability impact | Low |
| Exploit code maturity | Proof of concept |
| Remediation level | Official fix |
| Report confidence | Confirmed |
Description
Weak authentication in Azure DevOps Server allows an authorized attacker to elevate privileges over a network.
Frequently asked questions (Microsoft)
According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to prepare the target environment to improve exploit reliability.
**How could an attacker exploit this vulnerability? According to the CVSS metrics, successful exploitation of this vulnerability could lead to major loss of confidentiality (C:H), and some loss of integrity (I:L), and some loss of availability (A:L). What does that mean for this vulnerability? **
An attacker who successfully exploited this vulnerability could gains read access to the Elasticsearch search corpus but tamper or delete only search index and not the actual source of data. This will make search functionality temporarily unavailable until indices are rebuilt.
Affected products (1)
Developer Tools
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Azure DevOps Server 2025 | Release Notes | Security Update | 20260304.1 | Yes |
Acknowledgments
- alittleston3
- bilguun bicktivism
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. |