Azure Pipelines EUVD-2026-108537

The CVSS vector indicates no authentication, no user interaction, and low complexity (AV:N/AC:L/PR:N/UI:N), consistent with remote unauthenticated exploitation of Azure Pipelines. However, the available sources do NOT name the specific feature, pipeline configuration, input field, or deployment mode that carries the injectable parameter - the exact trigger is not described in the available sources, so defenders cannot yet scope which pipeline configurations or exposure modes are reachable. The primary limiting factor is network reachability of the vulnerable Azure Pipelines component; for Microsoft-hosted (cloud SaaS) service the vendor patch is applied server-side, whereas self-hosted/on-prem Azure DevOps Server deployments would require administrators to apply the official fix. No non-default configuration prerequisite is stated in the input.

This is a genuine high-priority issue, and the signals largely agree. The CVSS 3.1 base vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity flaw requiring no privileges and no user interaction, with high confidentiality and integrity impact (C:H/I:H) - a classic unauthenticated remote-code-execution profile for a command-injection weakness (CWE-77). The temporal metrics reinforce urgency: RC:C (Confirmed report) and RL:O (Official Fix available) are backed by the Microsoft MSRC advisory, and E:P indicates proof-of-concept exploit maturity rather than a fully weaponized or actively-exploited exploit. The vuln.today decision label is 'act_now', consistent with the high base score and PoC-level maturity. Two caveats must be stated explicitly: (1) this CVE is NOT in CISA KEV and no active-exploitation evidence is provided, so despite the 9.1 score and act_now label this is not confirmed in-the-wild exploitation - the urgency derives from exploitability and PoC maturity, not observed attacks; (2) no EPSS score was supplied, so widespread-exploitation probability cannot be quantified from the input. The A:N metric (no availability impact) is notable for an RCE-class flaw and appears to be the vendor's own scoping; I would independently expect availability impact from arbitrary code execution. Net: treat as a real, patch-now priority driven by unauthenticated network RCE potential, while not overstating it as confirmed active exploitation.

A remote attacker sends a crafted request or pipeline input to an exposed Azure Pipelines service and injects shell/command metacharacters into a parameter that is passed unsanitized to a command interpreter, achieving arbitrary code execution over the network without authentication or user interaction. The CVSS temporal E:P metric indicates proof-of-concept exploit maturity exists, though the input does not confirm fully working, publicly available exploit code. Low attack complexity (AC:L) means no special timing or environmental conditions are needed once the vulnerable input path is reached.