CVE-2026-105014: Command Injection in Azure Pipelines

CVE-2026-105014 is a command injection vulnerability in Azure Pipelines. The flaw allows an unauthorized attacker to execute remote code on pipeline agents, compromising the entire integration and deployment chain. Azure Pipelines is the core of CI/CD systems for thousands of organizations: a flaw here directly impacts the security of DevOps infrastructures and software delivery processes.

The CVSS score is 9.1 and severity is declared critical: remote code execution without authentication is one of the most serious threats to modern infrastructures. The vulnerability was published on October 22, 2026. A significant signal comes from the security community: on October 28, a public detection tool appeared (Python detector with auditable CSV/JSON inventories) documenting the presence of applicable vulnerabilities in environments. This signal indicates the flaw is already under active scrutiny.

For defenders: immediately check your Azure Pipelines version in use. Consult Microsoft's official advisories for affected versions and patches. Monitor pipeline logs for anomalous activity: command injection will leave traces. Limit service account permissions to the principle of least privilege and implement access restrictions on pipelines. If you run Azure Pipelines in production, updating is of high priority.