Live › vulnerability › CVE-2026-105014
Go to dashboardAzure Pipelines has a command injection flaw that lets an unauthorized attacker execute code over the network. The sources say Microsoft has mitigated it in the hosted cloud service, so no customer patch is described.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Azure Pipelines | vendor | cloud service, mitigated by Microsoft | – |
Unknown from the sources.
No customer action described; Microsoft reports the hosted Azure Pipelines service is mitigated. unknown for self-hosted Azure DevOps Server.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network.
This page as .md · .json · in your agent: get_signal("CVE-2026-105014")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.