Microsoft Azure DevOps Server: Authorization bypass leading to privilege escalation
Summary
A flaw in self-hosted Azure DevOps Server allows an authorization bypass through a user-controlled key (CWE-639, insecure direct object reference). An attacker with a valid low-privileged account on the network can elevate privileges, with high impact on confidentiality, integrity and availability. Azure DevOps Services (cloud) is not covered by this description. The CVSS score and CWE are taken from the request and could not be independently verified.
Affected
- Microsoft Azure DevOps Server 1.0.0 to before Patch 10 (according to the official CVE record)
- Exact affected builds: Unknown.
Fixed in
Unknown. The Patch 9 release notes do not link to this CVE. Check the MSRC advisory for the fixed build.
Workaround
Unknown. No vendor mitigation guidance was found. Until a fix is confirmed, restrict accounts with valid access to the server and review project and group permissions.
Exploitation
Unknown. No public reports of exploitation in the wild or public proof-of-concept code were found.
Our recommendation
- Identify every self-hosted Azure DevOps Server instance and its exact build.
- Read the MSRC advisory for the affected and fixed builds, then apply the update as a priority.
- Review accounts and group memberships on each server, especially developer and contractor accounts.
- Check whether the server is reachable from the internet and restrict access to the company network if possible.
- Monitor authentication and permission changes on the server.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide: CVE-2026-85923 msrc.microsoft.com
- Azure DevOps Server release notes learn.microsoft.com
- Azure DevOps Server lifecycle (endoflife.date) endoflife.date
- Microsoft November 2026 Patch Tuesday coverage cybersecuritynews.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 20:57.
Original description (NVD)
Authorization bypass through user-controlled key in Azure DevOps Server allows an authorized attacker to elevate privileges over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.