CVE-2026-105014: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') in Microsoft Azure Pipelines

This vulnerability, identified as CWE-77 (Improper Neutralization of Special Elements used in a Command), exists in Microsoft Azure Pipelines. It allows remote code execution by an unauthorized attacker due to improper sanitization of command inputs. The flaw is exploitable over a network without requiring privileges or user interaction. The CVSS 3.1 base score is 9.1, reflecting critical impact on confidentiality and integrity. Microsoft manages Azure Pipelines as a cloud service and has released an official fix to remediate this issue.

Successful exploitation allows an attacker to execute arbitrary code remotely on the Azure Pipelines service, compromising confidentiality and integrity of the environment. Availability impact is not indicated. This could lead to unauthorized control over pipeline operations and potentially sensitive data exposure.

Microsoft has released an official fix for this vulnerability. Since Azure Pipelines is a cloud-hosted service, Microsoft manages the remediation server-side. Users should review the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105014 for detailed guidance and ensure their Azure Pipelines instances are updated accordingly.