Azure Pipelines Critical RCE Vulnerability (CVE-2026-105014)
A new critical vulnerability (CVE-2026-105014) has been disclosed in Azure Pipelines, allowing an unauthorized attacker to execute code over a network. Microsoft’s Security Response Center (MSRC) published the details on October 22, 2026, alongside related security updates. What the vulnerability is CVE-2026-105014 is a command injection flaw classified under CWE-77 (Improper Neutralization of Special Elements used in a Command). The vulnerability type is listed as “Improper neutralization of special elements used in a command (command injection)” in the MSRC CVSS vector description. ...