PULSEUnderground Intel

LIVE23signals / 24h

FEED

ransomn0n reclama a Company #69 · Not Foundransomiah6477 reclama a alera · Professional Servicesransomn0n reclama a Company #68 · US · Not Foundransomn0n reclama a Company #67 · NL · Not Foundransomn0n reclama a Company #66 · Not Foundransomn0n reclama a Interior Technologies · Technologyransomeclipse reclama a Taiwan Otsuka Pharmaceutical · TW · Healthcareransomeclipse reclama a japantimes.co.jp · JP · Otherransomakira reclama a FOODMatch · Agriculture and Food Productionransomakira reclama a Shediac Lobster Shop · CA · Retail & E-Commerceransomakira reclama a Torns Enterprises · Not Foundransomkairos reclama a Oceania Digital Communications · VU · Technologyransomincransom reclama a FINANCIAMENTO LTDA · BR · Financial Servicesransomqilin reclama a MOA Architecture · SG · Professional Servicesransomn0n reclama a Company #69 · Not Foundransomiah6477 reclama a alera · Professional Servicesransomn0n reclama a Company #68 · US · Not Foundransomn0n reclama a Company #67 · NL · Not Foundransomn0n reclama a Company #66 · Not Foundransomn0n reclama a Interior Technologies · Technologyransomeclipse reclama a Taiwan Otsuka Pharmaceutical · TW · Healthcareransomeclipse reclama a japantimes.co.jp · JP · Otherransomakira reclama a FOODMatch · Agriculture and Food Productionransomakira reclama a Shediac Lobster Shop · CA · Retail & E-Commerceransomakira reclama a Torns Enterprises · Not Foundransomkairos reclama a Oceania Digital Communications · VU · Technologyransomincransom reclama a FINANCIAMENTO LTDA · BR · Financial Servicesransomqilin reclama a MOA Architecture · SG · Professional Services

CVE WatchOct 13, 2026

CVE-2026-69877

Origin validation error in Azure DevOps allows an unauthorized attacker to disclose information over a network.

CVSS

6.5

Medium

EPSS

0.4%

p33

KEV

—

Exploit Today

10

0-100

Published: Oct 13, 2026 · Last modified: Oct 13, 2026 · CWE-346

EPSS · 30d

Not enough EPSS history yet.

Technical description

Origin validation error in Azure DevOps allows an unauthorized attacker to disclose information over a network.

Official references

msrc.microsoft.comhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69877

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-101897—

——0Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 1.20.0 until 1.21.1, the Angular DevTools background service worker accepts chrome.runtime.sendMessage runtime messages from untrusted web pages or third-party content scripts without adequately verifying the message source. An untrusted sender that obtains a valid randomized victim tabId can direct the extension to use chrome.debugger to attach to another browser tab and trigger Chrome DevTools Protocol breakpoints. This can display the debugging banner, pause JavaScript execution, and prevent interaction with the target tab, but it does not provide remote code execution, privilege escalation, or cross-origin access to memory or credentials. This issue is fixed in version 1.21.1.17h CVE-2026-973819.9 CRI

——3Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the hosting document's hostname, a hostname that is not on the permitted list falls through without setting E_ACCESSDENIED, causing IsPermitted to return S_OK. An attacker who induces a user to visit a malicious webpage in Internet Explorer can invoke the control to enumerate update and system information, install updates without consent, display dialogs, or restart the computer when a reboot is pending. This issue was fixed in Legacy Update 1.13.2.1d CVE-2026-962386.5 MED

——4Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network.2d CVE-2026-962345.3 MED

——6Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.2d CVE-2026-881325.9 MED

——7Origin validation error in Azure Key Vault allows an unauthorized attacker to disclose information over a network.2d CVE-2026-702138.0 HIG

——7Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network.2d