Azure DevOps: Improper authentication leading to remote code execution
Summary
Improper authentication in Microsoft Azure DevOps allows an attacker with a valid, low-privileged account to execute code over the network. The scope-changed rating means the impact may extend beyond the vulnerable component. The CVE is rated CVSS 9.9 (Critical), and NVD analysis was still pending at publication.
Affected
- According to the CVE record: Microsoft Azure DevOps 1.0.0 to before publication date (unverified)
- According to the CVE record: Azure DevOps Server 2025 1.0.0.0 to before Patch 9 (unverified)
- Azure DevOps Services (cloud) is operated by Microsoft; whether it is affected is unknown.
Fixed in
Unknown. Azure DevOps Server Patch 9 was released on 13 Oct 2026, but it is not confirmed that it contains the fix for this CVE. Check the Microsoft advisory.
Workaround
Unknown. No vendor workaround has been identified. General interim measures: restrict network access to the Azure DevOps Server, review accounts with access, and monitor authentication logs.
Exploitation
- Not known to be exploited in the wild.
- No public proof of concept was found; the search coverage was limited.
Our recommendation
- Check the Microsoft Security Update Guide for affected products, versions and fixes, and confirm whether your deployment is affected.
- Identify all self-hosted Azure DevOps Server instances, their versions and whether they are reachable from the internet.
- Apply the vendor fix as soon as it is confirmed; until then, limit network exposure.
- Review accounts with access, including contractor and low-privilege accounts, and remove unneeded ones.
- Monitor authentication logs for unusual activity and recheck NVD and CISA KEV once analysis is complete.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-109467 msrc.microsoft.com
- Azure DevOps Server release notes learn.microsoft.com
- Azure DevOps Server Patch 9 security fixes (October 2026) windowsforum.com
- OffSeq threat radar: CVE-2026-109467 radar.offseq.com
- Azure DevOps Server (Wikipedia) en.wikipedia.org
- SentinelOne: CVE-2023-21553 (similar earlier flaw, context only) www.sentinelone.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 20:21.
Original description (NVD)
Improper authentication in Azure DevOps allows an authorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.