---
id: "CVE-2026-105014"
kind: "vulnerability"
aliases: ["CVE-2026-105014"]
title: "Azure Pipelines: command injection lets an outsider run code over the network"
severity: "critical"
cvss: 9.1
epss: 0.00667
exploited: false
status: "resolved"
category: "vendor"
products: [{"name": "Azure Pipelines", "fixed": [], "affected": "cloud service, mitigated by Microsoft", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["azure-devops", "azure-pipelines", "cloud-service", "vendor"]
not_affected_if: ["self-hosted-only"]
published_at: "2026-10-22T22:17:52+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105014", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:13:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-105014", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Azure Pipelines: command injection lets an outsider run code over the network

Azure Pipelines has a command injection flaw that lets an unauthorized attacker execute code over the network. The sources say Microsoft has mitigated it in the hosted cloud service, so no customer patch is described.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Azure Pipelines affected cloud service, mitigated by Microsoft fixed ?

## Fix

No customer action described; Microsoft reports the hosted Azure Pipelines service is mitigated. unknown for self-hosted Azure DevOps Server.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105014
- 2026-10-23T22:13:28+00:00 analyst — Read MSRC advisory: cloud service CVE (Azure Pipelines), already fully mitigated by Microsoft, no customer action. Not publicly disclosed, not exploited. MSRC lists no Azure DevOps Server (on-prem) product or build numbers, so on-prem is unconfirmed. Credit: Jianyang Song.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-105014

## Documents

- [advisory] MSRC: CVE-2026-105014 Azure Pipelines Remote Code Execution Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105014

## From the sources

Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_