In May 2025, Microsoft disclosed a critical security vulnerability in Azure DevOps Server, identified as CVE-2025-29813. This flaw, rated with a maximum CVSS score of 10.0, allows unauthorized attackers to elevate their privileges over a network by exploiting assumed-immutable data within the...
An elevation of privilege vulnerability exists in Azure DevOps Server and Team Foundation Services due to improper handling of pipeline job tokens. An attacker who successfully exploited this vulnerability could extend their access to a project.
To exploit this vulnerability, an attacker would...