Improper Authentication in Azure DevOps and Azure DevOps Server - CVE-2026-109467
Published: November 10, 2026
Vulnerability identifier: #VU164737
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-109467
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code on pipeline agents.
The vulnerability exists due to improper authentication in Azure DevOps when handling requests to execute pipelines. A remote user can send a specially crafted network request with Project Reader access to an affected organization to trigger unauthorized pipeline execution and execute arbitrary code on pipeline agents.
Affected software
Azure DevOps
Azure DevOps Server
Azure DevOps Server
How to mitigate CVE-2026-109467
Install security update from vendor's website.
Azure DevOps Server - update to Patch 9