Microsoft Azure DevOps Server: Elevation of privilege via weak authentication
Summary
Weak authentication in Microsoft Azure DevOps Server allows an authenticated attacker with network access to elevate privileges. Per the CNA record, the affected range is Azure DevOps Server 2025 from 1.0.0.0 to before 20260304.1. The attacker must already hold a valid low-privileged account, and the CVSS vector rates attack complexity as high.
Affected
- Microsoft Azure DevOps Server 2025 (on-premises): 1.0.0.0 to before 20260304.1 (per CNA record, not confirmed against MSRC)
- Other Azure DevOps Server releases: Unknown.
Fixed in
- Fixed build: Unknown. Verify on the MSRC Security Update Guide before acting.
Workaround
- Unknown. No official mitigation guidance was found.
Exploitation
- Not known to be exploited in the wild.
- CISA KEV: not listed.
- Rapid7 rates exploitation as less likely; no public proof of concept found.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Identify all Azure DevOps Server instances and confirm the current build.
- Verify the fixed build on the MSRC page and apply the Microsoft update as soon as it is confirmed.
- Review accounts with access to the server and remove unneeded rights.
- Restrict internet exposure of the server; prioritise internet-facing instances.
- Monitor for unusual privilege changes and logins.
- NVD analysis is pending; re-check the CVSS score and CWE later.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide: CVE-2026-120783 msrc.microsoft.com
- Strix CVE record CVE-2026-120783 www.strix.ai
- Rapid7 Patch Tuesday November 2026 www.rapid7.com
- Cybersecurity News: Microsoft November 2026 Patch Tuesday cybersecuritynews.com
- WindowsForum: Azure DevOps Server Patch 9 October 2026 windowsforum.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 13:47.
Original description (NVD)
Weak authentication in Azure DevOps Server allows an authorized attacker to elevate privileges over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.