{"id":"CVE-2026-105014","kind":"vulnerability","aliases":["CVE-2026-105014"],"related":[],"title":"Azure Pipelines: command injection lets an outsider run code over the network","description":"Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network.","summary":"Azure Pipelines has a command injection flaw that lets an unauthorized attacker execute code over the network. The sources say Microsoft has mitigated it in the hosted cloud service, so no customer patch is described.","severity":"critical","cvss":9.1,"epss":0.00667,"exploited":false,"exploited_at":null,"products":[{"name":"Azure Pipelines","fixed":[],"affected":"cloud service, mitigated by Microsoft","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["azure-devops","azure-pipelines","cloud-service","vendor"],"not_affected_if":["self-hosted-only"],"how_to_check":null,"fix":"No customer action described; Microsoft reports the hosted Azure Pipelines service is mitigated. unknown for self-hosted Azure DevOps Server.","status":"resolved","published_at":"2026-10-22T22:17:52+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:31:42+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T22:31:42Z","model":"claude-haiku-5-5","output":{"fix":"No customer action described; Microsoft reports the hosted Azure Pipelines service is mitigated. unknown for self-hosted Azure DevOps Server.","reach":"network","title":"Azure Pipelines: command injection lets an outsider run code over the network","impact":"high","summary":"Azure Pipelines has a command injection flaw that lets an unauthorized attacker execute code over the network. The sources say Microsoft has mitigated it in the hosted cloud service, so no customer patch is described.","category":"vendor","who_cares":["azure-devops","azure-pipelines","cloud-service"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs code on the pipeline service over the network.","analyst_note":"Confirm whether self-hosted Azure DevOps Server is affected and get the Microsoft advisory text at https://nvd.nist.gov/vuln/detail/CVE-2026-105014.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["self-hosted-only"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000492,"input_tokens":2917,"output_tokens":400,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-105014 for affected services, patched state, and whether Azure DevOps Server (on-prem) is affected; the NVD entry alone gives no product or version detail.","search":"'-105014':15A,18A '-2026':14A,17A 'allow':80C 'attack':42B,83C 'azur':1A,22B,25B,31B,78C 'azure':19A 'azure-devop':21B 'azure-pipelin':24B 'cloud':28B,58B 'cloud-servic':27B 'code':9A,44B,86C 'command':3A,35B,74C,75C 'custom':62B 'cve':13A,16A 'describ':65B 'devop':23B 'element':70C 'execut':43B,85C 'flaw':37B 'host':57B 'improp':66C 'inject':4A,36B,76C 'let':5A,39B 'microsoft':51B 'mitig':53B 'network':12A,47B,89C 'neutral':67C 'outsid':7A 'patch':63B 'pipelin':2A,26B,32B,79C 'pipelines':20A 'run':8A 'say':50B 'servic':29B,59B 'sourc':49B 'special':69C 'unauthor':41B,82C 'use':71C 'vendor':30B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T22:17:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105014","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105014","severity":null,"published_at":"2026-10-22T22:17:52+00:00","modified_at":"2026-10-23T19:43:46+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-105014:184","url":null,"severity":null,"published_at":"2026-10-23T22:13:28+00:00","modified_at":"2026-10-23T22:13:28+00:00","first_seen_at":"2026-10-23T22:13:28+00:00","fetched_at":"2026-10-23T22:13:28+00:00","note":"Read MSRC advisory: cloud service CVE (Azure Pipelines), already fully mitigated by Microsoft, no customer action. Not publicly disclosed, not exploited. MSRC lists no Azure DevOps Server (on-prem) product or build numbers, so on-prem is unconfirmed. Credit: Jianyang Song."},{"source":"epss","external_id":"CVE-2026-105014","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105014","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[{"id":1335,"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105014","title":"MSRC: CVE-2026-105014 Azure Pipelines Remote Code Execution Vulnerability","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}