CVE-2026-23658 is a high severity flaw (CVSS 8.6) in Azure DevOps. The record says insufficiently protected credentials let an unauthorized attacker elevate privileges over a network. No versions are given, so read the Microsoft Security Response Center entry for fixes and any customer action before deciding what to do.
What's affected
The record names Microsoft Azure DevOps and describes insufficiently protected credentials that allow an unauthorized attacker to elevate privileges over a network.
It gives no versions or fixed builds. Azure DevOps Services is hosted by Microsoft, but many organizations also run Azure DevOps Server on their own infrastructure. We could not confirm from the page which of these needs action, so we do not state it. The MSRC entry for the CVE is the authority.
Build systems hold a lot of power: source code, secrets, deployment keys and the ability to ship to production. That is why a credential flaw here deserves attention even when the score is below critical.
How to check if you're exposed
Read the MSRC entry for CVE-2026-23658 and note whether it applies to the hosted service, to Azure DevOps Server, or both, and what update it names.
If you run Azure DevOps Server, find the build number from the administration console and compare it with the fixed build in the entry. Whatever you run, review which tokens, service connections and pipeline secrets exist, and when they were last rotated.
What to do now
- Read the MSRC entry and note any update or customer action.
- If you run Azure DevOps Server, apply the update it lists.
- Review personal access tokens, service connections and pipeline secrets, and remove those you do not need.
- Rotate secrets that grant deployment or production access, as a precaution.
- Check audit logs for unusual token creation or permission changes.
Why it matters
The record lists CWE-522 (Insufficiently Protected Credentials). Credentials were stored or handled in a way that allowed someone without access to get at them, which then supports raising privileges. The vector shows network reach, no privileges and no user interaction, with a changed scope and a high effect on confidentiality only.
Secrets in delivery systems are a recurring theme in supply chain incidents, because they open the door to the code and the release process. Keep pipeline secrets narrow, short lived and rotated. The record does not mark this CVE as a CISA Known Exploited Vulnerability.
Quick check
Is this fixed by Microsoft for me?
The record does not say. The MSRC entry explains what customers need to do, if anything.
Why rotate secrets if I patch?
Rotation limits the damage if a credential was exposed before the fix, and it is cheap compared with an incident.
Sources
Last reviewed: 19 October 2026.
