EUVD-2026-28460
GHSA-gmwx-3xm2-9fx8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Azure DevOps instance
-
DeliverySend crafted network request
-
ExploitTrigger information disclosure flaw
-
ExecutionExtract sensitive data (secrets/tokens/repos)
-
PersistPivot to connected Azure resources
-
ImpactExecute unauthorized operations
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against network-accessible Azure DevOps instances. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires only network connectivity to the Azure DevOps instance with no authentication, no complex timing or race conditions, and no user interaction. Both Azure DevOps Services (cloud) and Azure DevOps Server (on-premises) instances exposed to network access are vulnerable. The scope change (S:C) suggests the vulnerability may be exploitable through standard Azure DevOps API endpoints or web interfaces without requiring non-default configurations or enabled features. |
| Impact | This vulnerability represents critical enterprise risk despite no confirmed active exploitation (CISA KEV). The CVSS vector breakdown reveals maximum severity across all dimensions: network-accessible (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N), and causing high impact to confidentiality, integrity, and availability (C:H/I:H/A:H) with scope change (S:C). The scope change is particularly concerning as it suggests attackers could access secrets, credentials, or tokens within Azure DevOps that enable lateral movement to other Azure services or connected systems. While EPSS data is not provided, the combination of network accessibility, zero prerequisites, and cross-boundary impact makes this a realistic target for opportunistic scanning and exploitation. The immediate availability of an official Microsoft patch (RL:O) elevates this to a patch-now priority for any organization using Azure DevOps. The absence of KEV listing may reflect recent disclosure timing rather than low exploitability. Organizations should assume this will be actively targeted once vulnerability details become public. |
| Exploit ScenarioDerived | An unauthenticated remote attacker identifies an exposed Azure DevOps instance through internet scanning and crafts network requests that exploit the information disclosure flaw to extract sensitive data such as repository contents, pipeline secrets, service connection credentials, or authentication tokens. The attacker leverages the scope change characteristic to use extracted credentials or tokens to pivot into connected Azure resources, compromise CI/CD pipelines to inject malicious code, or access production systems that trust Azure DevOps authentication. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 07, 2026
Unauthorized information disclosure in Azure DevOps allows remote unauthenticated attackers to access sensitive data via network requests and potentially compromise the system with high confidentiality, integrity, and availability impact. The vulnerability carries a maximum CVSS 10.0 score with scope change, indicating cross-boundary impact. Microsoft has released an official patch, and no active exploitation has been reported via CISA KEV at the time of analysis.
RemediationAI
Apply the vendor-released patch immediately by consulting the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42826 for exact update procedures and patched versions. For Azure DevOps Services (cloud), Microsoft typically applies security updates automatically to the service, but administrators should verify their instance has been updated and review any required configuration changes. For Azure DevOps Server (on-premises), download and install the security update package following Microsoft's deployment guidance, which typically requires service restart and may involve brief downtime for the DevOps platform. As an interim compensating control if patching must be delayed, implement network-level restrictions to limit Azure DevOps access to trusted IP ranges via firewall rules or Azure Network Security Groups, though this only reduces attack surface and does not eliminate the vulnerability. Review Azure DevOps audit logs for suspicious access patterns to sensitive repositories, pipelines, or secrets during the exposure window. Rotate any credentials, personal access tokens, and service connection secrets that may have been exposed, prioritizing those with elevated privileges or access to production environments.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in microsoft
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) vulnerability affecting Microsoft Azure DevOps, a comprehensive DevOps platform providing source control, CI/CD pipelines, artifact repositories, and project management capabilities. The vulnerability exposes sensitive data through improper access controls or information leakage mechanisms accessible over network protocols. The scope change (S:C) in the CVSS vector indicates the vulnerability transcends security boundaries, meaning an attacker could potentially pivot from Azure DevOps to impact resources in different security contexts, such as connected Azure resources, repositories, or downstream systems that trust Azure DevOps authentication tokens or secrets. The perfect 10.0 CVSS score with network vector and no complexity barriers suggests a fundamental flaw in access control or data protection mechanisms within the platform's network-facing components.
Know when Azure Devops gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unauthorized attacker to disclose information over a network.
Executive ViewAI
CVE-2026-42826 is a critical vulnerability in Azure DevOps that allows unauthenticated remote attackers to access sensitive data and potentially compromise system integrity and availability across organizational boundaries. This affects any organization using Azure DevOps for CI/CD pipelines, source code management, or build artifacts, creating immediate risk to intellectual property, deployment credentials, and development infrastructure. Microsoft has released a patch, making immediate remediation both necessary and achievable.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB