CVE-2025-29813 is a critical (CVSS 10.0) authentication bypass in Microsoft Azure DevOps. The record describes authentication bypass by assumed-immutable data that lets an unauthorized attacker elevate privileges over a network. Read the Microsoft Security Response Center guide for fixed versions and any steps you must take.
What's affected
The record lists Microsoft Azure DevOps as the affected product and gives no version numbers. I could not retrieve the Microsoft update guide page when preparing this post, so I cannot confirm affected builds, fixed builds, or whether customers need to act.
Microsoft's guide for this CVE is the authority. Check it for whether the issue affects the hosted service, Azure DevOps Server (the self hosted product), or both, and for any required updates.
The record does not flag the CVE as known exploited (it is not in the CISA KEV catalog at the time of writing).
How to check if you're exposed
Start with what you actually run.
- Decide whether your team uses the hosted Azure DevOps service, a self hosted Azure DevOps Server, or both.
- For a self hosted server, find the installed build number in the administration console and compare it with the fixed build in Microsoft's guide.
- For the hosted service, read the guide to see whether Microsoft states that action is needed on your side.
Also review audit logs for unexpected permission changes, new service connections, new personal access tokens, and changes to pipeline settings.
What to do now
- Read the MSRC update guide entry for CVE-2025-29813 and note the affected and fixed versions.
- If you run Azure DevOps Server, schedule the update through your normal change process and test it first.
- Review organization and project permissions, group membership and recent audit log entries for anything you cannot explain.
- Rotate service connection secrets and personal access tokens that you cannot account for, and prefer short lived credentials.
- Document the result so the next review can see what you verified.
Why it matters
The record maps the flaw to CWE-287 (Improper Authentication) and CWE-302 (Authentication Bypass by Assumed-Immutable Data). The second one describes a system that trusts a value it assumes the caller cannot change, when the caller actually can. That breaks the check that decides who someone is or what they may do.
A score of 10.0 reflects network reach, no required privileges per the vector, and a change of scope. Azure DevOps sits close to source code, build pipelines and deployment credentials, so a privilege escalation there can reach into other systems. That is the reason delivery platforms deserve the same care as production services.
Because I could not read the vendor page, I am not making claims about exploit status beyond the record. Verify against the guide.
Quick check
Does this affect the hosted service or only the server product?
The record does not say. Check Microsoft's guide, which should state it.
What should I review after patching?
Audit logs, permission groups, personal access tokens, service connections and pipeline definitions, looking for changes you did not make.
Sources
Last reviewed: 19 October 2026.
