CVE-2026-105014
Azure Pipelines Remote Code Execution vulnerability
MSRC advisory October 22, 2026
Alert details
- Source feed
- Microsoft MSRC
- CVE ID
- CVE-2026-105014
- CWE
- CWE-77
- Affected products
- Azure Pipelines Remote Code Execution · Microsoft Azure Pipelines Remote Code Execution · Microsoft
What happened
Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network.
What it means for your business
Azure Pipelines Remote Code Execution vulnerability (CVE-2026-105014) was added to Microsoft’s security update guidance. Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network. If you need help checking exposure, call (864) 335-9223.
CVSS score
9.1 (Critical)
EPSS probability
0.67%
Sources
Related briefs
Microsoft Exchange Online Remote Code Execution vulnerability
Microsoft Exchange Online Remote Code Execution vulnerability (CVE-2026-96185) was added to Microsoft’s security update guidance. Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network. If you need help checking exposure, call (864) 335-9223.
Azure Kubernetes Configuration Service Elevation of Privilege vulnerability
Azure Kubernetes Configuration Service Elevation of Privilege vulnerability (CVE-2026-83938) was added to Microsoft’s security update guidance. Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network. If you need help checking exposure, call (864) 335-9223.
Azure AI Foundry Elevation of Privilege vulnerability
Azure AI Foundry Elevation of Privilege vulnerability (CVE-2026-108456) was added to Microsoft’s security update guidance. Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network. If you need help checking exposure, call (864) 335-9223.
Windows DNS Information Disclosure vulnerability
Windows DNS Information Disclosure vulnerability (CVE-2026-70074) was added to Microsoft’s security update guidance. Updated an acknowledgement. This is an informational change only. If you need help checking exposure, call (864) 335-9223.
Need help patching?
PremierePC monitors KEV alerts for managed clients and helps teams prioritize remediation before attackers do.