Overview
CVE-2026-105014 is a command injection vulnerability (CWE-77) in Microsoft Azure Pipelines. Improper neutralization of special elements in a command lets an unauthorized attacker execute code over the network. Microsoft published the advisory on October 22, 2026 with a CVSS 3.1 base score of 9.1 (temporal 8.2) and a maximum severity of Critical.
The vector is network-based with low complexity, and requires no privileges and no user interaction. Impact is high for confidentiality and integrity, and none for availability.
Status
| Item | Detail |
|---|---|
| Customer action | None required, per Microsoft |
| Exploited in the wild | Not listed in CISA KEV at time of writing |
| Root cause details | Not published |
Because Azure Pipelines is a Microsoft-operated service, the fix is applied on the service side. Microsoft has not shared exploitation specifics, and NVD analysis was still pending when this was written.
Recommended Actions
Although no patching is needed, defenders should use the disclosure as a prompt to harden CI/CD:
- Review pipeline logs for the period around disclosure for unexpected tasks, scripts or outbound connections.
- Audit service connections and secrets available to pipelines; rotate any that are broadly scoped.
- Treat pipeline parameters and variables as untrusted input in scripts, and avoid interpolating them directly into shell commands.
- Self-hosted agents are your own responsibility: keep them patched, isolated and ephemeral where possible.