Zero Radar
← feed
CriticalVulnerabilityCVE-2026-105014updated 25 Oct 2026, 17:05 UTC

Azure Pipelines allows remote code execution by unauthorized attackers

Azure Pipelines is Microsoft's service that runs software build and deployment jobs. A flaw lets an outside attacker, with no login, send specially crafted input over the network and make the service run commands of their choice.

Official, 3 sources
SeverityCriticalCVSS 9.1 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 3 sourcesBacked by an official source

What happened

Improper neutralization of special elements in Azure Pipelines leads to command injection, letting an unauthorized attacker execute code remotely over a network.

Why it is dangerous: A successful attacker could run arbitrary code on systems handling builds and deployments, potentially reaching secrets and code used to ship software. Any organization using the affected service is at risk.

Are you affected?

You are affected if you use Azure Pipelines in an affected version; the material does not specify exact versions or configurations.

Azure Pipelines (specific versions unknown)

What to do

  1. Check the Microsoft MSRC advisory for CVE-2026-105014 for the official fix or mitigation for Azure Pipelines
  2. Apply the patch or mitigation Microsoft specifies as soon as it is available to you
  3. Review Azure Pipelines access logs and restrict network exposure where possible

Timeline

  1. 22 Oct 2026, 14:00 UTC
    Publicly disclosed
  2. 22 Oct 2026, 14:00 UTC
    Reported by Microsoft MSRC · Microsoft MSRC
  3. 22 Oct 2026, 22:17 UTC
    Reported by NVD · NVD
  4. 25 Oct 2026, 17:05 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 3 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-105014 · GHSA-vg36-vcf8-m9cg
CVSS
9.1 / 10
EPSS
0.7% chance of exploitation within 30 days
Disclosed
22 Oct 2026, 14:00 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 17:05 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Azure Pipelines allows remote code execution by unauthorized attackers · Zero Radar