Microsoft Azure Devops Server vulnerabilities

40 CVEs affecting Microsoft Azure Devops Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-21512, published 2026-02-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-1306, published 2019-09-11. Critical severity, CVSS 9.8. EPSS: 17% chance of exploitation in the next 30 days. A remote code execution vulnerability exists when Azure DevOps Server (ADO) and Team Foundation Server (TFS) fail to validate input properly, aka 'Azure DevOps and Team Foundation Server Remote Code…
CVE-2019-1072, published 2019-07-15. Critical severity, CVSS 9.8. EPSS: 13.4% chance of exploitation in the next 30 days. A remote code execution vulnerability exists when Azure DevOps Server and Team Foundation Server (TFS) improperly handle user input, aka 'Azure DevOps Server and Team Foundation Server Remote Code…
CVE-2019-0971, published 2019-05-16. Medium severity, CVSS 6.5. EPSS: 8.5% chance of exploitation in the next 30 days. An information disclosure vulnerability exists when Azure DevOps Server and Microsoft Team Foundation Server do not properly sanitize a specially crafted authentication request to an affected server,…
CVE-2019-0857, published 2019-04-09. Medium severity, CVSS 6.5. EPSS: 3.9% chance of exploitation in the next 30 days. A spoofing vulnerability that could allow a security feature bypass exists in when Azure DevOps Server does not properly sanitize user provided input, aka 'Azure DevOps Server Spoofing Vulnerability'.
CVE-2019-0875, published 2019-04-09. High severity, CVSS 7.5. EPSS: 3% chance of exploitation in the next 30 days. An elevation of privilege vulnerability exists when Azure DevOps Server 2019 does not properly enforce project permissions, aka 'Azure DevOps Server Elevation of Privilege Vulnerability'.
CVE-2021-27067, published 2021-04-13. Medium severity, CVSS 6.5. EPSS: 2.6% chance of exploitation in the next 30 days. Azure DevOps Server and Team Foundation Server Information Disclosure Vulnerability
CVE-2019-0866, published 2019-04-09. Medium severity, CVSS 6.1. EPSS: 2.6% chance of exploitation in the next 30 days. A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server…
CVE-2019-0871, published 2019-04-09. Medium severity, CVSS 6.1. EPSS: 2.4% chance of exploitation in the next 30 days. A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server…
CVE-2019-0870, published 2019-04-09. Medium severity, CVSS 6.1. EPSS: 2.4% chance of exploitation in the next 30 days. A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server…
CVE-2019-0868, published 2019-04-09. Medium severity, CVSS 6.1. EPSS: 2.4% chance of exploitation in the next 30 days. A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server…

Latest

CVE-2026-21512, published 2026-02-10. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. Server-side request forgery (ssrf) in Azure DevOps Server allows an authorized attacker to perform spoofing over a network.
CVE-2024-35267, published 2024-07-09. High severity, CVSS 7.6. EPSS: 1.6% chance of exploitation in the next 30 days. Azure DevOps Server Spoofing Vulnerability
CVE-2024-35266, published 2024-07-09. High severity, CVSS 7.6. EPSS: 1.6% chance of exploitation in the next 30 days. Azure DevOps Server Spoofing Vulnerability
CVE-2024-20667, published 2024-02-13. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. Azure DevOps Server Remote Code Execution Vulnerability
CVE-2023-21751, published 2023-12-14. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. Azure DevOps Server Spoofing Vulnerability
CVE-2023-36561, published 2023-10-10. High severity, CVSS 7.3. EPSS: 0.9% chance of exploitation in the next 30 days. Azure DevOps Server Elevation of Privilege Vulnerability
CVE-2023-38155, published 2023-09-12. High severity, CVSS 8.1. EPSS: 1.3% chance of exploitation in the next 30 days. Azure DevOps Server Remote Code Execution Vulnerability
CVE-2023-33136, published 2023-09-12. High severity, CVSS 8.8. EPSS: 1.7% chance of exploitation in the next 30 days. Azure DevOps Server Remote Code Execution Vulnerability
CVE-2023-36869, published 2023-08-08. Medium severity, CVSS 6.3. EPSS: 0.7% chance of exploitation in the next 30 days. Azure DevOps Server Spoofing Vulnerability
CVE-2023-21569, published 2023-06-14. Medium severity, CVSS 5.5. EPSS: 0.7% chance of exploitation in the next 30 days. Azure DevOps Server Spoofing Vulnerability