Main Vulnerability Database SB20261111108

SB20261111108 - Weak Authentication in Azure DevOps Server

Published: November 11, 2026

Security Bulletin ID SB20261111108

CSH Severity

Low

Patch available

YES

Number of vulnerabilities 1

Exploitation vector Remote access

Highest impact Data manipulation

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 1 vulnerability.

1) Weak Authentication (CVE-ID: CVE-2026-120783)

CWE-ID: CWE-1390 - Weak Authentication

CVSSv4: 6.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to escalate privileges, disclose search data, and temporarily disrupt search functionality.

The vulnerability exists due to weak authentication in Azure DevOps Server when handling network access. A remote user can prepare the target environment and exploit weak authentication to read the Elasticsearch search corpus and modify or delete search indices, temporarily disrupting search functionality.

Tampering and deletion are limited to search indices and do not affect the underlying source data.

Remediation

Install update from vendor's website.

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-120783