Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-109467: Azure DevOps Server lets attacker run code remotely
CVE-2026-109467 · published today
Summary
Azure DevOps Server 2025 may let a signed‑in user run their own programs on the server over the network. This could let an attacker take control of the server or steal data. Install the latest security update from Microsoft as soon as possible and limit access to trusted users only.
What to do
- Update microsoft azure devops to version publication or later.
- Update microsoft azure devops server 2025 to version Patch 9 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| microsoft | azure devops | < publication |
| microsoft | azure devops server 2025 | < Patch 9 |
Original advisory text
Azure DevOps Server Remote Code Execution Vulnerability
Improper authentication in Azure DevOps allows an authorized attacker to execute code over a network.
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109467 vendor-advisory patch
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-287Improper Authentication
Timeline
Published10 Nov 2026
Updated11 Nov 2026
First seen10 Nov 2026
Track software like this
Free during beta