This vulnerability (CVE-2026-42826) in Microsoft Azure DevOps involves the exposure of sensitive information to unauthorized actors over a network, classified as CWE-200. The CVSS v3.1 base score is 10.0, reflecting critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and complete confidentiality, integrity, and availability impact. The vulnerability affects the cloud-hosted Azure DevOps service. Microsoft has released an official fix and manages remediation for this cloud service. No known active exploits have been reported.

An unauthorized attacker can disclose sensitive information over the network without any privileges or user interaction, potentially compromising confidentiality, integrity, and availability of the Azure DevOps environment. This can lead to severe data breaches and operational impact on affected Azure DevOps instances.

Microsoft has provided an official fix for this vulnerability and manages remediation for the Azure DevOps cloud service. Users should verify that their Azure DevOps environment is updated according to Microsoft's guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42826. No additional user action is required beyond ensuring the service is up to date as managed by Microsoft.