CVE-2026-42826

—

CVSS 3.1

7.5 high

EPSS

<1%p56

Published

May 7, 2026 (May 7, 2026)

Modified

Jun 17, 2026

Description

Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unauthorized attacker to disclose information over a network.

Vendors: microsoft
Products: azure devops
Weakness: CWE-200
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.8%)

In the news1 stories

Microsoft Patches 138 Vulnerabilities, Including DNS and Netlogon RCE Flaws

The Hacker NewsMay 15, 00:00 UTC · May 15, 2026Vulnerability in the wildCVE-2025-54518 CVE-2026-41096 CVE-2026-42826+14 CVEs1

60