Critical Azure DevOps Information Disclosure Vulnerability Addressed (msrc.microsoft.com)

• Critical CVSS 10.0 vulnerability in Azure DevOps
• Allows unauthenticated remote attackers to access sensitive info
• Fixed by Microsoft at the service level

"Microsoft has remediated a critical (CVSS 10.0) information disclosure vulnerability in Azure DevOps that enabled unauthenticated remote attackers to obtain sensitive data. The vulnerability, tracked as CVE-2026-42826, was fixed at the service level, meaning no immediate action is required from Azure DevOps users. However, administrators should verify that their environments are running the latest updates. This is one of the highest-severity vulnerabilities disclosed in the Azure ecosystem this year, highlighting the importance of prompt vendor patch adoption."