CVE-2023-38155 Azure DevOps Server Remote Code Execution Vulnerability

High 7.0 Published 12 Sep 2023 Updated 30 Oct 2025

An attacker can achieve remote code execution on Azure DevOps Server via a deserialization vulnerability.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-38155?

CVE-2023-38155 is a high-severity unsafe deserialization vulnerability in Microsoft Azure DevOps Server, published on 12 Sep 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Azure DevOps Server Remote Code Execution Vulnerability

Weakness: CWE-502

Which versions are affected by CVE-2023-38155?

It affects 1 product.

Products include Microsoft Azure Devops Server.

How do I fix CVE-2023-38155?

No fix has been published for CVE-2023-38155 yet. Limit exposure of the affected software until one is available.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2023-38155 being exploited?

There is no known exploitation of CVE-2023-38155 in the wild and no public exploit code.

Sources

Also known as GHSA-jw6j-8p3q-xrff.