CVE-2018-8529

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 13.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-11-15 · updated 2026-06-17

Description

A remote code execution vulnerability exists when Team Foundation Server (TFS) does not enable basic authorization on the communication between the TFS and Search services, aka "Team Foundation Server Remote Code Execution Vulnerability." This affects Team.

Affected products

Microsoft Team Foundation Server 2018: 2018-1.1, 2018-3
Microsoft Team: Foundation Server 2018 Update 1.1, Foundation Server 2018 Update 3

References

http://www.securityfocus.com/bid/105910
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8529
http://www.securityfocus.com/bid/105910
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8529

Get alerted when CVE-2018-8529 or the next vulnerability affects your stack