Azure DevOps EUVD-2026-28460

Apply the vendor-released patch immediately by consulting the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42826 for exact update procedures and patched versions. For Azure DevOps Services (cloud), Microsoft typically applies security updates automatically to the service, but administrators should verify their instance has been updated and review any required configuration changes. For Azure DevOps Server (on-premises), download and install the security update package following Microsoft's deployment guidance, which typically requires service restart and may involve brief downtime for the DevOps platform. As an interim compensating control if patching must be delayed, implement network-level restrictions to limit Azure DevOps access to trusted IP ranges via firewall rules or Azure Network Security Groups, though this only reduces attack surface and does not eliminate the vulnerability. Review Azure DevOps audit logs for suspicious access patterns to sensitive repositories, pipelines, or secrets during the exposure window. Rotate any credentials, personal access tokens, and service connection secrets that may have been exposed, prioritizing those with elevated privileges or access to production environments.