SB20261111112 - Command injection in Azure Web Apps
Published: November 11, 2026
Security Bulletin ID
SB20261111112
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Command injection (CVE-ID: CVE-2026-119989)
CWE-ID: CWE-77 - Command injection
CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code as the pipeline agent account.
The vulnerability exists due to command injection in Azure Pipelines when an existing build processes application files under specific pipeline configurations. A remote user can place specially crafted content in those files to execute arbitrary code as the pipeline agent account.
Remediation
Install update from vendor's website.