Microsoft's Security Update Guide published it on 22 October 2026 at 07:00 US Pacific time (14:00 UTC; 10:00 pm Perth) CVE-2026-105014, 'Azure Pipelines Remote Code Execution Vulnerability': command injection (CWE-77) in Azure Pipelines allows an unauthorised attacker to execute code over a network. Microsoft rates it Critical with a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Microsoft's temporal metrics mark exploit code maturity as proof-of-concept (E:P).

Microsoft's FAQ says the vulnerability has already been fully mitigated by Microsoft, there is no action for users of the service to take, and the CVE is published to provide further transparency.

Microsoft lists it as not publicly disclosed and not exploited. It was one of six Microsoft cloud-service CVEs published that day; the others are on their own desk cards. Primary: Microsoft Security Response Center; CVE record.