Microsoft says an authorized network attacker can use the flaw to execute code.The issue carries a CVSS 3.1 base score of 9.9. It affects Azure DevOps and Azure DevOps Server 2025, with Patch 9 listed as the Server 2025 fix.
What it allows
How Can CVE-2026-109467 Affect Azure DevOps Pipelines?
The attacker must already have Project Reader access to an affected Azure DevOps organization. Microsoft says a crafted network request can then trigger pipeline execution without additional user interaction.
Successful exploitation may execute code on pipeline agents. Because the CVSS scope is changed, the impact can cross from the vulnerable service into a separately governed pipeline-agent environment.
Microsoft assessed the flaw as not publicly disclosed and not exploited when it published the record. Brandefense Blackhole recorded one dark-chat mention during the 90 days ending November 10, 2026.
Who is affected
Which Azure DevOps Versions Are Affected by CVE-2026-109467?
Microsoft lists Azure DevOps and Azure DevOps Server 2025 as known affected products. The record does not identify an earlier Server branch as affected.
For Azure DevOps Server 2025, Microsoft identifies Patch 9 as the vendor fix. The hosted Azure DevOps product also has a vendor-fix entry, but Microsoft does not publish a customer-managed build number for it.
Exposure requires Project Reader access to the affected organization and network reachability to Azure DevOps. Teams should still prioritize the update because successful abuse may reach code-running pipeline agents.
Timeline
- 2026-11-10
Microsoft published the advisory and listed Azure DevOps Server 2025 Patch 9 as the security update.
What to do
-
Install Azure DevOps Server 2025 Patch 9
Apply Microsoft's listed security update to every Azure DevOps Server 2025 deployment. Confirm Patch 9 is installed after maintenance.
-
Inventory Project Reader access
Identify accounts and service identities with Project Reader access. Remove access that is no longer required and investigate unexpected grants.
-
Review pipeline execution history
Brandefense recommends reviewing pipeline runs and authorization changes around the disclosure window. Investigate executions that lack an expected operational trigger.
-
Protect pipeline agents
Restrict agent network access and credentials to the minimum required scope. Rotate exposed secrets if review finds suspicious pipeline activity.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability Intelligence
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What is CVE-2026-109467?
It is a CVSS 9.9 improper-authentication vulnerability in Azure DevOps. An authorized network attacker may trigger pipeline execution and run code on pipeline agents.
Does CVE-2026-109467 require authentication?
Yes. Microsoft says the attacker needs Project Reader access to an affected Azure DevOps organization. No additional user interaction is required.
Which Azure DevOps products are affected?
Microsoft lists Azure DevOps and Azure DevOps Server 2025 as known affected. Its record does not identify another Server branch as affected.
How do teams fix CVE-2026-109467?
Azure DevOps Server 2025 administrators should install Patch 9. Hosted Azure DevOps customers should verify service status and review Project Reader access and pipeline activity.
Sources
- CVE-2026-109467 Security Update GuideMicrosoft Security Response Center
- CVE-2026-109467 DetailNational Vulnerability Database
