CVE-2026-21512

MEDIUM

Microsoft Azure Devops Server < 2022.2.0 - SSRF

Title source: rule

Server-side request forgery (ssrf) in Azure DevOps Server allows an authorized attacker to perform spoofing over a network.

CVSS v3 6.5

EPSS 0.0006

EPSS Percentile 18.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-918

Status published

microsoft/azure_devops_server < 2022.2.0

microsoft/azure_devops_server

Published Feb 10, 2026

Tracked Since Feb 18, 2026