Azure DevOps CLI EUVD-2026-99597

Exploitation requires a user to actively invoke the vulnerable Azure DevOps CLI Extension (version 1.0.6, fixed in 1.0.7) or Azure CLI against an origin that the attacker controls or can influence, triggering the origin validation error (CWE-346) that leaks high-confidentiality data. The key LIMITING factors are: required user interaction (CVSS UI:R) - the victim must run a CLI command, so there is no silent remote server-side exploitation; the affected surface is client-side developer/CI tooling rather than the hosted Azure DevOps service; and systems patched to Azure DevOps CLI Extension 1.0.7 or later are not vulnerable. No attacker authentication is needed (PR:N).

This is a moderate-severity information disclosure flaw (CVSS 6.5) in the Azure DevOps CLI extension / Azure CLI, not the Azure DevOps web service - an important distinction, since the affected component is developer/CI-side tooling rather than a server-side endpoint. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) indicates a network-reachable, low-complexity, unauthenticated attack that nonetheless requires user interaction (UI:R) and yields high confidentiality impact with no integrity or availability effect. All exploitation signals point AWAY from urgent priority: CISA SSVC rates Exploitation as 'none', Automatable 'no', and Technical Impact only 'partial'; there is no CISA KEV listing and no public exploit identified. EPSS is not provided in the input, so probabilistic exploitation likelihood cannot be quantified. The combination of PR:N but UI:R is notable - although no privileges are needed, the requirement that a user actively run a CLI command (likely against an attacker-influenced origin, consistent with CWE-346 origin validation error) substantially limits opportunistic mass exploitation. Overall this reads as a genuine but non-urgent patch-in-normal-cycle issue rather than a high-real-risk emergency.

An attacker lures a developer into running an Azure DevOps CLI command that interacts with an attacker-controlled or attacker-influenced endpoint; because the extension fails to properly validate the response origin (CWE-346), sensitive information such as tokens or project data is disclosed to the wrong party. The attack requires the victim to take an action (UI:R) but no authentication on the attacker's part. No public proof-of-concept exploit has been identified at the time of analysis.