An Azure DevOps component dubbed msazure stores credentials in an insufficiently protected manner. This flaw enables an attacker who can reach the system over a network to acquire those credentials and subsequently elevate privileges. The consequence is a compromise of account and the potential to modify or delete data, undermining confidentiality and integrity.

The vulnerability applies to Microsoft Azure DevOps services, specifically the msazure component referenced by the vendor. No explicit affected version ranges are listed in the CNA data, so administrators cannot rely on version numbers alone and should verify all deployed instances.

The flaw is rated a high CVSS score of 8.6 and has an EPSS less than 1%, indicating low likelihood of widespread exploitation at present. It is not yet catalogued in CISA’s KEV list. The attack vector is inferred to be network based, allowing an unauthorized remote actor to acquire privileges without local access.