9.1 Critical

CVE-2026-105014 Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an…

Description

Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network.

Affected products and versions

Product	Affected versions	Fixed in
Azure Pipelines	Versions not published

Do you use Azure Pipelines?

Track this CVE Watch Azure Pipelines Check my SBOMs

www.cveye.io/en/cve/CVE-2026-105014

Timeline

Published October 22, 2026
Last modified October 31, 2026

References

Azure Pipelines Remote Code Execution Vulnerability msrc.microsoft.com

Track this CVE