CVE-2019-1306

CVE Enrichment

CVSS: 9.8 CRITICAL
EPSS: 16.99%
EPSS Percentile: 97.04%
CISA KEV: Not listed

Description

A remote code execution vulnerability exists when Azure DevOps Server (ADO) and Team Foundation Server (TFS) fail to validate input properly, aka 'Azure DevOps and Team Foundation Server Remote Code Execution Vulnerability'.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: secure@microsoft.com
Published: 12-Sep-2019 05:15
Last Modified: 17-Jun-2026 09:28
EPSS Date: 2026-10-16
CWE: CWE-20

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

microsoft / team_foundation_server
Version / affected range: 2018
cpe:2.3:a:microsoft:team_foundation_server:2018:3.2:*:*:*:*:*:*
microsoft / azure_devops_server
Version / affected range: 2019
cpe:2.3:o:microsoft:azure_devops_server:2019:update1:*:*:*:*:*:*
microsoft / azure_devops_server
Version / affected range: 2019.0.1
cpe:2.3:o:microsoft:azure_devops_server:2019.0.1:*:*:*:*:*:*:*

References

af854a3a-2127-422b-91ae-364da2661108

Last enrichment sync: 17-Oct-2026 12:16
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

on the darknet by the user known by the moniker, PresidentXS, that discusses an Azure vulnerability, CVE-2019-1306, “Azure DevOps and Team Foundation Server Remote Code Execution Vulnerability.” An attacker What CVEs Are and How They Help Track Security Vulnerabilities
A recent Azure vulnerability, CVE-2019-1306, “Azure DevOps and Team Foundation Server Remote Code Execution Vulnerability” was explicitly posted to a hacker forum on the darknet by the user known by the moniker, DarkOwl Details Darknet Tactics Targeting Cloud Platforms

CVE (5)

Malware (2)

People (2)

Threat Actors (11)

MITRE ATT&CK (5)

Vendors (7)

Products (13)

Tools (3)

Industries (5)

Countries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.