Weak Authentication in Azure DevOps Server - CVE-2026-120783
Published: November 11, 2026
Vulnerability identifier: #VU165416
CSH Severity: Low
CVSS v4: 6.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-120783
CWE-ID: CWE-1390
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to escalate privileges, disclose search data, and temporarily disrupt search functionality.
The vulnerability exists due to weak authentication in Azure DevOps Server when handling network access. A remote user can prepare the target environment and exploit weak authentication to read the Elasticsearch search corpus and modify or delete search indices, temporarily disrupting search functionality.
Tampering and deletion are limited to search indices and do not affect the underlying source data.
Affected software
Azure DevOps Server
How to mitigate CVE-2026-120783
Install security update from vendor's website.
Azure DevOps Server - update to 20260304.1