Azure Pipelines Remote Code Execution Vulnerability
CVE-2026-119989 is a remote code execution vulnerability in Azure Pipelines (rated Important, CVSS 8.2).
1 version
Facts
- Microsoft id
CVE-2026-119989- Products
- Azure Pipelines
- Severity
- Important
- Impact
- Remote Code Execution
- CVSS
- 8.2
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C
- Exploited
- No
- Publicly disclosed
- No
- Exploitability
- Exploitation Less Likely
- Customer action required
- Yes
- Release
- 2026-Nov
- Assigned by
- Microsoft
- Weakness
- CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
- MSRC revision
- 1.0
- Status pages
- Azure DevOps status
- First captured by us
- Microsoft last modified
- Source
- Security updates · open the original at Microsoft
Microsoft's revision notes
- Revision 1.0, 2026-11-10:
Information published.
Microsoft says
Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an authorized attacker to execute code over a network.
What Microsoft changed
One version so far. If Microsoft edits it, each change shows here with what was removed and added.
First version we captured ·
The text as we first saw it
Seen by us · Microsoft's timestamp · Microsoft's page
Related changes
Other changes for Azure DevOps
- Public Preview: GitHub Advanced Security for Azure DevOps · In preview
- Azure DevOps Information Disclosure Vulnerability
- Introducing Developer Velocity Lab to improve developers’ work and well-being · Launched
- Token lifecycle management is now in private preview · In preview
- Public preview: Application Insights work item integration for Azure DevOps & GitHub · In preview
- Jenkins plug-ins for Azure are being retired on 29 February 2024
- General availability: Azure DevOps Delivery Plans 2.0 · Launched
- General Availability: GitHub Advanced Security for Azure DevOps · Launched
Last updated