Critical severity9.8NVD Advisory· Published Sep 11, 2019· Updated Jun 17, 2026

CVE-2019-1306

Description

A remote code execution vulnerability exists when Azure DevOps Server (ADO) and Team Foundation Server (TFS) fail to validate input properly, aka 'Azure DevOps and Team Foundation Server Remote Code Execution Vulnerability'.

Affected products

Microsoft/Team Foundation Serverllm-fuzzy2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: Update 3.2
Microsoft/Azure DevOps Serverllm-fuzzy
Microsoft/Azure Devopscpe-rescue2 versions
2019.0.1+ 1 more
- (no CPE)range: 2019.0.1
- (no CPE)range: unspecified

Patches

Vulnerability mechanics

References

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1306nvdPatchVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.014
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000