Azure Pipelines: Command injection leading to remote code execution

Summary

A command injection flaw (CWE-77) in Azure Pipelines allows an authorized attacker to execute code over the network. The CVE record's affected-product field names Microsoft Azure Web Apps instead, so the exact product scope must be confirmed in the MSRC advisory. Attack complexity is high and the scope is changed, with high confidentiality and integrity impact. The attacker needs a valid low-privileged account; the CVE record does not state whether the flaw is internet-facing.

Affected

• Product named in the CVE title: Azure Pipelines
• Product named in the CVE affected field: Microsoft Azure Web Apps
• Version range per CVE record: 1.0.0 to before 2.10.0
• Unknown whether this range applies to Azure Pipelines; confirm in the MSRC advisory.

Fixed in

Unknown. No confirmed fixed build was found; check the MSRC advisory.

Workaround

Unknown. No vendor workaround was found. If the affected service is Microsoft-hosted, customer action may not be needed; verify in the MSRC advisory.

Exploitation

• No public proof of concept or exploitation in the wild was found at the time of research.
• Rapid7 lists the exploitation assessment as Exploitation Less Likely and the CVE as not publicly disclosed.
• CISA SSVC: Exploitation none, Automatable no.
• CISA KEV: not listed in the snapshot; recheck.

Our recommendation

• Confirm in the MSRC advisory whether your organisation uses Azure Pipelines or Azure Web Apps, and which versions.
• Apply the vendor fix as soon as it is confirmed.
• Review who can edit pipelines and who holds service connections; remove rights that are not needed.
• Check accounts with this access, especially developer and contractor accounts.
• Recheck KEV and NVD status once NVD analysis is published.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide (MSRC) msrc.microsoft.com
• CVE.org record CVE-2026-119989 www.cve.org
• Strix CVE-2026-119989 www.strix.ai
• Rapid7 Patch Tuesday November 2026 www.rapid7.com
• OpenCVE Azure Pipelines app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 01:28.