Microsoft Azure DevOps Server: Server-side request forgery leading to information disclosure
Summary
A server-side request forgery (SSRF) vulnerability in Azure DevOps Server allows an authenticated attacker with low privileges to make the server send requests to unintended destinations over the network. This can disclose information the attacker should not be able to access, with a high impact on confidentiality and no impact on integrity or availability. No user interaction is required, and the CVSS score is 6.5 (medium) as published by the CNA; NVD analysis was still pending at the time of writing.
Affected
- Microsoft Azure DevOps Server: versions 1.0.0 to before Patch 8
- Microsoft Azure DevOps (cloud service): versions 1.0.0 to before Sprint 278
Fixed in
- Microsoft Azure DevOps Server: Patch 8
- Microsoft Azure DevOps (cloud service): Sprint 278 (service-side fix, no customer action)
Workaround
Unknown.
Exploitation
- No confirmed exploitation in the wild.
- Not publicly disclosed; no public proof of concept found.
- CISA SSVC: exploitation none, not automatable, partial technical impact.
- Not listed in CISA KEV.
Our recommendation
- Apply Microsoft Azure DevOps Server Patch 8 promptly, prioritising internet-facing instances and servers with many user accounts.
- Verify the Knowledge Base article and download source on the MSRC page before rollout.
- Review accounts that can create or edit service connections and hooks, and restrict self-registration.
- Monitor logs for unusual outbound requests from the Azure DevOps Server.
- Cloud-only customers need no on-premises action.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide: CVE-2026-112745 msrc.microsoft.com
- CVE Record CVE-2026-112745 www.cve.org
- Rapid7: November 2026 Patch Tuesday www.rapid7.com
- Strix: CVE-2026-112745 www.strix.ai
- Talos: Microsoft Patch Tuesday November 2026 blog.talosintelligence.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 12:27.
Original description (NVD)
Server-side request forgery (ssrf) in Azure DevOps Server allows an authorized attacker to disclose information over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.