Introduction
A critical information disclosure flaw in Microsoft Azure DevOps, with the maximum CVSS 3.1 base score of 10.0, could have allowed an unauthenticated attacker to expose sensitive data over a network without any user interaction. Microsoft mitigated the vulnerability entirely on its own infrastructure before publishing the CVE on May 7, 2026. That puts it among the more notable examples of Microsoft's newer transparency initiative for cloud service vulnerabilities.
Technical Information
CVE-2026-42826 is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The CVSS 3.1 vector describes a vulnerability with minimal barriers to exploitation:
| Metric | Value | Implication |
|---|---|---|
| Base Score | 10.0 | Maximum critical severity |
| Temporal Score | 8.7 | Adjusted for remediation status and exploit maturity |
| Attack Vector | Network | Exploitable remotely |
| Attack Complexity | Low | Minimal preconditions for the attacker |
| Privileges Required | None | No authentication needed |
| User Interaction | None | No legitimate user action required |
| Scope | Changed | Impact extends beyond the vulnerable component's security authority |
| Confidentiality Impact | High | Sensitive data fully compromised |
| Integrity Impact | High | Data modification possible |
| Availability Impact | High | Service disruption possible |
Unauthenticated, network-accessible exploitation, a changed scope, and high impact across all three CIA dimensions together push the base score to a perfect 10.0.
What We Know (and Don't Know)
Microsoft's advisory does not disclose the exact attack vectors, the specific Azure DevOps subcomponents affected, or the precise exploitation methodology. Public documentation also includes no forensic guidance and no timeline for the exposure window. This level of opacity is consistent with how Microsoft handles cloud service CVEs. The vulnerability existed and was resolved entirely within Microsoft's managed infrastructure, so Microsoft does not publish a detailed technical breakdown.
Given how many services Azure DevOps includes, we can still assess the theoretical scope of data at risk:
- Azure Repos: proprietary source code and intellectual property
- Azure Pipelines: build configurations, deployment credentials, and secrets
- Azure Boards: strategic project plans, work items, and bug reports
- Azure Test Plans: QA data and information about system vulnerabilities
- Azure Artifacts: internal software packages and dependency metadata
Without more granular disclosure from Microsoft, we cannot determine which subcomponent was affected or what data types were actually exposed during the vulnerability window.
Patch Information
CVE-2026-42826 is an exclusively hosted service vulnerability in Azure DevOps. Microsoft applied the fix entirely on its own infrastructure. There is no downloadable patch, KB article, or customer-installable update.
The MSRC Security Update Guide entry, released on May 7, 2026, states: "This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take." The advisory says the CVE exists solely to provide transparency.
This follows the broader initiative Microsoft described in "Toward greater transparency: Unveiling Cloud Service CVEs", under which Microsoft began assigning CVEs to cloud-side vulnerabilities that have already been resolved server side, even when customers need to take no action.
These indicators confirm the fix is in place:
- Remediation Level: Official Fix. The CVSS temporal metrics confirm that a complete vendor solution is available.
- Customer Action Required: Not Required, as listed in the Security Updates table on the MSRC page.
- Exploit Code Maturity: Unproven. No public exploit code exists, and the vulnerability was not exploited in the wild before the advisory.
- NVD Tag:
exclusively-hosted-service. The tag means the cloud provider manages the vulnerable component entirely and the patch lifecycle is outside customer control.
The MSRC update table for this CVE lists dashes for the Article, Download, and Build Number columns. This is standard for cloud service CVEs where Microsoft handles patching behind the scenes. No code diffs, commits, or installable updates exist.
For governance purposes, organizations should log this CVE in their vulnerability management systems and record that the provider assumed full responsibility for remediation. Security teams should also watch the newer column in the MSRC Security Update Guide that shows whether future cloud CVEs require customer action.
Affected Systems and Versions
The vulnerability affects Microsoft Azure DevOps as a cloud-hosted service. Because Azure DevOps is a SaaS platform managed entirely by Microsoft, no specific version numbers, build numbers, or customer-installable software versions are associated with this CVE. The NVD entry tags this as an exclusively-hosted-service vulnerability, which confirms that the affected component runs solely on Microsoft's infrastructure.
All Azure DevOps tenants were potentially in scope before Microsoft's server-side mitigation. This advisory does not implicate any on-premises or self-hosted configurations.
Vendor Security History
Microsoft published CVE-2026-42826 as part of a deliberate policy shift. Historically, cloud service vulnerabilities resolved server side did not receive CVE identifiers, which left security teams tracking their exposure with a visibility gap. Assigning CVEs to these cloud-side issues, even when customers need to take no action, is a meaningful step toward transparency. The MSRC remains the central coordination point for vulnerability reports across all Microsoft products and services.
References
- CVE-2026-42826: MSRC Security Update Guide
- CVE-2026-42826: NVD Entry
- CVE-2026-42826: GitHub Advisory (GHSA-gmwx-3xm2-9fx8)
- CVE-2026-42826: Tenable
- Toward Greater Transparency: Unveiling Cloud Service CVEs
- Microsoft Security Update Guide
- MSRC Release Notes: April 2026
- What is Azure DevOps? (Microsoft Learn)
- CISA Known Exploited Vulnerabilities Catalog
