DMZ//THREAT INTEL
FEED ACTIVELAST SYNC: 06:03:37ZSOURCES: 14CRITICAL: 15
⚠ ACTIVE ALERTS
SYLVANITE CRITICAL — SYLVANITE is a newly named Dragos-tracked threat group identified as a dedicated… /// @MsftSecIntel CRITICAL — We are tracking TeamPCP (UNC6780) activity following the GitHub internal repository… /// @GossiTheDog CRITICAL — The GitHub / TeamPCP breach is now being monetized on BreachForums. Listing is up — $95k… /// @struppigel CRITICAL — SUPPLY CHAIN ALERT: Laravel-Lang PHP packages backdoored May 22-23 via hijacked GitHub… /// @MalwareHunterTeam CRITICAL — Seeing fresh DebugElevator stealer log batches already appearing for sale on Exploit.in —…
15Critical Threats
8Active CVEs
0IOCs Tracked
0New Advisories
INTEL FEED/CVE TRACKER/CVE-2026-42826
TLP:WHITEVULNERABILITY BRIEF // CVE-2026-42826PUBLISHED: 2026-05-07
■ CRITICALCVE-2026-42826

Azure DevOps Unauthenticated Information Disclosure

VENDOR: Microsoft//PRODUCT: Azure DevOps
10
CRITICAL
CVSS 3.1
✓
PATCH STATUS
PATCH AVAILABLE
◯
EXPLOIT STATUS
NO KNOWN EXPLOIT

VULNERABILITY OVERVIEW

An exposure of sensitive information to an unauthorized actor (CWE-200) in Azure DevOps allows an unauthenticated remote attacker to disclose sensitive information over the network with no user interaction required. Despite the CVSS 10.0 base score and full CHI impact ratings, Microsoft proactively remediated this vulnerability within its cloud infrastructure without requiring customer intervention, publishing the CVE for transparency. The risk to organizations storing source code, build pipelines, secrets, and API keys in Azure DevOps is considered high given the platform's role in software supply chain security.

CVSS BREAKDOWN

↗
Attack Vector
NETWORK
△
Attack Complexity
LOW
⚷
Privs Required
NONE
◈
User Interaction
NONE
⊕
Scope / Impact
CHANGED
C:H · I:H · A:H
AFFECTED VERSIONSAzure DevOps (cloud service); Microsoft has already fully mitigated on the service side — no customer action required

CITATIONS

  • → https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42826
  • → https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-may-2026/
  • → https://socradar.io/blog/may-2026-patch-tuesday-zero-day/
  • → https://nvd.nist.gov/vuln/detail/CVE-2026-42826
SHARE BRIEF:✕ Post on Xin Share on LinkedIn