Skip to main content

Azure CVE-2026-21512

MEDIUM
Server-Side Request Forgery (SSRF) (CWE-918)
2026-02-10 secure@microsoft.com
SSRF Microsoft Azure Azure Devops Server
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

2
Analysis Generated
Mar 12, 2026 - 22:02 vuln.today
CVE Published
Feb 10, 2026 - 18:16 nvd
MEDIUM 6.5

DescriptionCVE.org

Server-side request forgery (ssrf) in Azure DevOps Server allows an authorized attacker to perform spoofing over a network.

AnalysisAI

Authenticated users of Azure and Azure DevOps Server can exploit a server-side request forgery vulnerability to perform network-based spoofing attacks. This MEDIUM severity issue (CVSS 6.5) requires valid credentials but allows attackers to manipulate the server into making unauthorized requests, potentially compromising confidentiality. No patch is currently available.

Technical ContextAI

Classified as CWE-918 (Server-Side Request Forgery (SSRF)). Affects Azure Devops Server. Server-side request forgery (ssrf) in Azure DevOps Server allows an authorized attacker to perform spoofing over a network.

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

More in Azure

View all
CVE-2026-62874 CRITICAL POC
9.8 Sep 18

Privilege escalation in Microsoft's Azure Billing service allows unauthenticated, remote attackers to reach full comprom
CVE-2026-23889 MEDIUM POC
6.5 Jan 26

Path traversal in pnpm's tarball extraction on Windows allows attackers to write files outside the intended package dire
CVE-2026-31957 CRITICAL
10.0 Mar 11

Default password in Himmelblau Azure Entra ID suite 3.0.0-3.0.x. CVSS 10.0.
CVE-2026-85878 CRITICAL
9.9 Sep 18

Privilege escalation in Azure Database for PostgreSQL allows an authenticated attacker with low privileges to elevate pr
CVE-2026-70200 CRITICAL
9.8 Sep 17

Path traversal in Microsoft's Azure Logic Apps (CWE-22) lets a remote, unauthenticated attacker escape an intended restr
CVE-2025-20286 CRITICAL
9.9 Jun 04

Default credentials in Cisco ISE cloud deployments on AWS/Azure/OCI. CVSS 9.9.
CVE-2026-85889 CRITICAL
9.8 Sep 17

Unauthenticated remote attackers can reach a critical function inside Microsoft Azure AI Foundry that performs a privile
CVE-2026-21531 CRITICAL
9.8 Feb 10

Deserialization of untrusted data in Azure SDK allows unauthorized code execution over a network. EPSS 0.32%.
CVE-2026-24300 CRITICAL
9.8 Feb 05

Elevation of privilege vulnerability in Azure Front Door allows attackers to gain elevated access. Microsoft Azure cloud
CVE-2026-24306 CRITICAL
9.8 Jan 22

Azure Front Door has an improper access control vulnerability (CVSS 9.8) allowing unauthorized attackers to elevate priv
CVE-2026-3224 CRITICAL
9.8 Mar 03

Azure AD auth bypass in Devolutions Server 2025.3.15.0 and earlier.
CVE-2026-23518 CRITICAL
9.8 Jan 21

Fleet device management software has a signature verification bypass that allows attackers to install malicious firmware

Same weakness CWE-918 – Server-Side Request Forgery (SSRF)

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2022-41040 HIGH POC
8.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-22054 HIGH POC
7.5
CVE-2021-21975 HIGH POC
7.5

Same technique SSRF

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-22054 HIGH POC
7.5
CVE-2021-21975 HIGH POC
7.5
CVE-2016-3718 MEDIUM POC
5.5

Share

CVE-2026-21512 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy