Command injection in Azure Web Apps - CVE-2026-119989
Published: November 11, 2026
Vulnerability identifier: #VU165426
CSH Severity: Medium
CVSS v4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-119989
CWE-ID: CWE-77
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code as the pipeline agent account.
The vulnerability exists due to command injection in Azure Pipelines when an existing build processes application files under specific pipeline configurations. A remote user can place specially crafted content in those files to execute arbitrary code as the pipeline agent account.
Affected software
Azure Web Apps
How to mitigate CVE-2026-119989
Install security update from vendor's website.
Azure Web Apps - update to 2.10.0