CVE-2026-23658Disclosure(microsoft / azure_devops)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch microsoft azure_devops systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Insufficiently protected credentials in Azure DevOps allows an unauthorized attacker to elevate privileges over a network.

microsoft CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23658

Weakness type (CWE)

CWE-522

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

azure_devops

Threat summary

Patch or workaround signal is available
10 mentions across 5 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 9 signals
Disclosure: 8 classified signals
General: 2 classified signals
Peaked 3d ago at 3 mentions (2026-03-20); latest day: 1
10 total mentions across 5 days

Affected systems

Vendors

microsoft

Products

azure_devops

1 version affected across 1 product

Deep dive

Activity timeline10 mentions / 5d

Signal classification2 categories

Disclosure

880.0%

General

220.0%

Referenced assets9 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-19	1	Disclosure1
2026-03-20	3	Disclosure1General2
2026-03-22	2	Disclosure2
2026-03-24	3	Disclosure3
2026-03-26	1	Disclosure1

Full discourse10 posts

Diyan Apostolov@thefosi198d
Disclosure
Reported 18 vulns - LPE to SYSTEM, pipeline secret theft, supply chain .Works out of the box. MSRC: "Moderate. No bounty. Config issue." 🙄 Microsoft 5 days later: CVE-2026-23658 -Azure DevOps EoP, CVSS 8.6 HIGH 👀 The market doesn't rate your 0days "Moderate." #MSRC
Post summary
The post announces 18 new vulnerabilities, including a high‑severity Azure DevOps privilege escalation CVE‑2026‑23658, but offers no exploit code, patches, or evidence of active exploitation.
01030192
50 followersView on X
dbugs@ptdbugs202d
Disclosure
Azure DevOps: msazure Elevation of Privilege Vulnerability CVE: CVE-2026-23658 PT-Identifier: PT-2026-26350 Vendor: Microsoft Product: Azure DevOps: msazure CVSS: 8.6 Credits: n/a Description: Insufficiently protected credentials in Azure DevOps allows an unauthorized attacker to elevate privileges over a network. References: • https://dbugs.ptsecurity.com/vulnerability/CVE-2026-23658 • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23658 #dbugs_vuln
Post summary
The text announces the Azure DevOps (msazure) elevation‑of‑privilege vulnerability CVE‑2026‑23658 with a CVSS score of 8.6, citing a vendor advisory but no evidence of exploits or active attacks.
02010158
649 followersView on X
kawn@kawn2020199d
Disclosure
#securityupdate #microsoft #定例外 2026. 3.19 Azure DevOps: msazure の特権昇格の脆弱性 CVE-2026-23658 Security Vulnerability リリース日: - マイクロソフト https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23658
Post summary
Microsoft released a security update for Azure DevOps (CVE-2026-23658) noting a privilege escalation vulnerability. The post does not provide a PoC, exploit tool, or active exploitation evidence, nor does it detail patches or mitigations.
1010077
88 followersView on X
kawn@kawn2020199d
Disclosure
#securityupdate #microsoft #定例外 CVE-2026-23658 Security Vulnerability 影響: 特権の昇格最大深刻度: 緊急 CVSS:3.1 8.6 / 7.5 悪用可能性・一般に公開: No ・悪用: No ・Exploitability assessment: 対象外 https://x.com/kawn2020/status/2036260653615436271
Post summary
The tweet announces a newly disclosed Microsoft privilege‑escalation vulnerability (CVE‑2026‑23658) with high severity scores, but does not provide any PoC, exploit, patch details, or evidence of active exploitation.
1000034
88 followersView on X
Aakash Rahsi@rahsi_aaka196d
Disclosure
CVE-2026-23658 | Azure DevOps: msazure Elevation of Privilege Vulnerability https://www.aakashrahsi.online/post/cve-2026-23658 https://t.co/fNHcRgtVMJ
Post summary
The text announces CVE‑2026‑23658, an elevation‑of‑privilege flaw in Azure DevOps, and links to a blog post but offers no further technical, exploit, or mitigation details.
0000036
1 followersView on X
Infoflowcloud@infoflowcloud200d
Disclosure
🚨*CVE* CVE-2026-23658 Insufficiently protected credentials in Azure DevOps allows an unauthorized attacker to elevate privileges over a network. https://www.cve.org/CVERecord?id=CVE-2026-23658 ----- Traducción: CVE-2026-23658 Credenciales insuficientemente protegidas en Azur… http://infoflow.cloud`
Post summary
The post discloses CVE‑2026‑23658, a privilege‑elevation flaw in Azure DevOps caused by insufficiently protected credentials, with no PoC, exploitation evidence, or patch mentioned.
0000021
61 followersView on X
CVE@CVEnew200d
Disclosure
CVE-2026-23658 Insufficiently protected credentials in Azure DevOps allows an unauthorized attacker to elevate privileges over a network. https://www.cve.org/CVERecord?id=CVE-2026-23658
Post summary
CVE-2026-23658 exposes a privilege‑elevation weakness due to insufficiently protected credentials in Azure DevOps, with no evidence of exploitation, patch, or PoC provided.
00000191
56.8K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds202d
General
CVE-2026-23658 Azure DevOps Privilege Escalation via Inadequate Credential Protection https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-23658
Post summary
The text offers a minimal mention of CVE‑2026‑23658 with a title indicating a privilege‑escalation issue in Azure DevOps and a link to a Vulmon page; no further technical or exploit details are provided.
0000036
4.0K followersView on X
RedPacket Security@RedPacketSec203d
General
CVE Alert: CVE-2026-23658 - Microsoft - Azure DevOps: msazure - https://www.redpacketsecurity.com/cve-alert-cve-2026-23658-microsoft-azure-devops-msazure/ #OSINT #ThreatIntel #CyberSecurity #cve-2026-23658 #microsoft #azure-devops-msazure
Post summary
The post announces a CVE alert for Microsoft Azure DevOps but provides no further details or actionable information.
0000081
3.6K followersView on X
CVEFind.com@CveFindCom203d
Disclosure
[CVE-2026-23658: HIGH] Insufficiently protected credentials in Azure DevOps allows an unauthorized attacker to elevate privileges over a network.#cve,CVE-2026-23658,#cybersecurity https://cvefind.com/CVE-2026-23658
Post summary
The tweet announces CVE-2026-23658 as a high‑severity privilege‑escalation flaw in Azure DevOps caused by insufficiently protected credentials, with no PoC, exploit, active exploitation, patch, or false‑positive information.
0000043
603 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	microsoft	azure_devops	-	-	-

Explore more

Back to dashboard microsoft CVEs azure_devops vulnerabilities

What researchers are saying

CVE-2026-23658

dbugs[verified]@ptdbugsDisclosure

The text announces the Azure DevOps (msazure) elevation‑of‑privilege vulnerability CVE‑2026‑23658 with a CVSS score of 8.6, citing a vendor advisory but no evidence of exploits or active attacks.

Diyan Apostolov@thefosiDisclosure

The post announces 18 new vulnerabilities, including a high‑severity Azure DevOps privilege escalation CVE‑2026‑23658, but offers no exploit code, patches, or evidence of active exploitation.

kawn@kawn2020Disclosure

Microsoft released a security update for Azure DevOps (CVE-2026-23658) noting a privilege escalation vulnerability. The post does not provide a PoC, exploit tool, or active exploitation evidence, nor does it detail patches or mitigations.

kawn@kawn2020Disclosure

The tweet announces a newly disclosed Microsoft privilege‑escalation vulnerability (CVE‑2026‑23658) with high severity scores, but does not provide any PoC, exploit, patch details, or evidence of active exploitation.

Aakash Rahsi@rahsi_aakaDisclosure

The text announces CVE‑2026‑23658, an elevation‑of‑privilege flaw in Azure DevOps, and links to a blog post but offers no further technical, exploit, or mitigation details.

Infoflowcloud@infoflowcloudDisclosure

The post discloses CVE‑2026‑23658, a privilege‑elevation flaw in Azure DevOps caused by insufficiently protected credentials, with no PoC, exploitation evidence, or patch mentioned.

CVE@CVEnewDisclosure

CVE-2026-23658 exposes a privilege‑elevation weakness due to insufficiently protected credentials in Azure DevOps, with no evidence of exploitation, patch, or PoC provided.

Vulmon Vulnerability Feed@VulmonFeedsGeneral

The text offers a minimal mention of CVE‑2026‑23658 with a title indicating a privilege‑escalation issue in Azure DevOps and a link to a Vulmon page; no further technical or exploit details are provided.