CVEDB API

Server-side request forgery (ssrf) in Azure DevOps Server allows an authorized attacker to perform spoofing over a network.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.001

EPSS Ranking 27.9%

CVSS Severity

CVSS v3 Score 6.5

References

Products affected by CVE-2026-21512

Microsoft » Azure Devops Server » Version: 2019

cpe:2.3:o:microsoft:azure_devops_server:2019
Microsoft » Azure Devops Server » Version: 2019.0.1

cpe:2.3:o:microsoft:azure_devops_server:2019.0.1
Microsoft » Azure Devops Server » Version: 2019.1.2

cpe:2.3:o:microsoft:azure_devops_server:2019.1.2
Microsoft » Azure Devops Server » Version: 2020

cpe:2.3:o:microsoft:azure_devops_server:2020
Microsoft » Azure Devops Server » Version: 2020.0.1

cpe:2.3:o:microsoft:azure_devops_server:2020.0.1
Microsoft » Azure Devops Server » Version: 2020.1.2

cpe:2.3:o:microsoft:azure_devops_server:2020.1.2
Microsoft » Azure Devops Server » Version: 2022

cpe:2.3:o:microsoft:azure_devops_server:2022
Microsoft » Azure Devops Server » Version: 2022.0.1

cpe:2.3:o:microsoft:azure_devops_server:2022.0.1
Microsoft » Azure Devops Server » Version: 2022.0.2

cpe:2.3:o:microsoft:azure_devops_server:2022.0.2
Microsoft » Azure Devops Server » Version: 2022.1.0

cpe:2.3:o:microsoft:azure_devops_server:2022.1.0
Microsoft » Azure Devops Server » Version: 2022.2.0

cpe:2.3:o:microsoft:azure_devops_server:2022.2.0