High MSRC-CVE-2026-112745 1 CVE

Azure DevOps Server Information Disclosure Vulnerability

Published Nov 10, 2026 · Updated Nov 10, 2026

Vendor: Microsoft

Summary

Impact: Information Disclosure. Microsoft rating: Important. Not known to be exploited — Exploitation More Likely. Customer action: Required.

Details

What type of information could be disclosed by this vulnerability?
Exploiting this vulnerability could allow the disclosure of credentials.

Security updates
Patch 8 — https://learn.microsoft.com/en-us/azure/devops/server/release-notes/azuredevopsserver?view=azure-devops#azure-devops-server-patch-8-release-date-september-10-2026

Vulnerabilities 1

Medium 6.5

CVE-2026-112745

Azure DevOps Server Information Disclosure Vulnerability

Server-side request forgery (ssrf) in Azure DevOps Server allows an authorized attacker to disclose information over a network.

Microsoft Azure DevOps Server Azure DevOps

Nov 10, 2026

Revision history

2026-11-10 #1
Information published.

References

CVE-2026-112745 Azure DevOps Server Information Disclosure Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-112745
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss