Today’s Topics:

• Hidden Pull Request Comments Can Hijack Azure DevOps AI Review Agents
• Adobe Patches CVSS 10.0 Campaign Classic Flaw Allowing Remote Code Execution
• How can Netizen help?

---

Hidden Pull Request Comments Can Hijack Azure DevOps AI Review Agents

A hidden HTML comment inside an Azure DevOps pull request can redirect an AI code-review agent, causing it to access projects, source code, pipelines, work items, and internal documentation that the attacker could not reach directly. The weakness affects Microsoft’s official Azure DevOps Model Context Protocol server and demonstrates how attacker-controlled text can inherit the permissions of a more privileged user once it enters an agent’s context.

Manifold Security disclosed the issue after examining how the Azure DevOps MCP server processes pull request descriptions. The server allows AI agents such as Copilot CLI and Claude Code to interact with Azure DevOps resources using the credentials of the person running the agent. These integrations can retrieve pull requests, inspect repositories, trigger pipelines, read wiki pages, access work items, and post comments.

That access creates a confused-deputy condition. An attacker with permission to create or modify a pull request can place instructions in content that will later be processed by an agent operating under a reviewer’s broader authorization. The attacker does not need the reviewer’s token or direct access to restricted projects. The agent becomes the intermediary that carries out the attacker’s instructions.

Azure DevOps pull request descriptions support Markdown and embedded HTML comments. Text placed between HTML comment tags remains hidden in the normal web interface, leaving reviewers with no visible indication that extra instructions are present. The Azure DevOps API still returns the comment as part of the raw pull request description, and the MCP server passes that content to the model.

This creates a material difference between what the reviewer sees and what the AI agent receives. A pull request can appear ordinary to a human reviewer yet contain a concealed prompt directing the agent to abandon the expected code-review task. The malicious instructions can ask the agent to invoke unrelated tools, search other projects, retrieve restricted information, and publish the results somewhere accessible to the attacker.

The attack relies on indirect prompt injection. The attacker never communicates with the model through the agent’s primary interface. Instead, the attacker places instructions inside data that the agent is expected to read. Once that data enters the model’s context, the model may treat the concealed text as an instruction rather than untrusted repository content.

The risk grows when the reviewer has greater Azure DevOps access than the person who opened the pull request. Senior engineers, maintainers, DevOps administrators, and security personnel often hold permissions across several repositories or projects. An attacker with access to one project can use a malicious pull request to borrow those broader privileges through the reviewer’s agent.

Manifold Security traced the weakness to inconsistent handling of external content inside the MCP server. Microsoft had already implemented a mitigation known as spotlighting for several response paths. This technique wraps untrusted content in delimiters and labels it as external data, helping the model distinguish repository content from legitimate system or user instructions.

The shared createExternalContentResponse helper had been applied to tools that return wiki pages and build logs. The function used to retrieve a pull request by its identifier, repo_get_pull_request_by_id, did not use the same wrapper. As a result, the pull request description reached the agent without the external-content treatment already present elsewhere in the server.

This gap is significant since pull request descriptions are directly controlled by contributors and are routinely supplied to AI code-review agents. A mitigation applied to most tool responses offers little protection when a single uncovered function exposes attacker-controlled content to the model without equivalent handling.

Manifold demonstrated the attack using a local build of version 2.7.0 of the Azure DevOps MCP server. A contributor created a normal-looking pull request containing a concealed payload. When a more privileged reviewer instructed an AI agent to review the pull request, the hidden prompt caused the agent to trigger a pipeline in another project, retrieve a confidential wiki page, and post the page’s contents back to the original pull request.

The attacker could then read the leaked information from the pull request comment. Each operation was technically permitted under the reviewer’s credentials. The security failure came from the sequence and purpose of those operations, which were controlled by hidden text that the reviewer could not see.

The researchers reproduced the behavior with both Copilot CLI and Claude Code, indicating that the issue is tied to the MCP server’s handling of untrusted data rather than one model or client. Any compatible agent that follows the injected instructions and has access to the required tools could expose the same weakness.

Several conditions must align for successful exploitation. The attacker needs permission to submit or edit pull request content. A more privileged user must invoke an AI agent against that content. The agent must have access to useful cross-project tools and must be permitted to execute those tools without meaningful approval checks.

Auto-approved tool execution produces the greatest exposure. Per-tool confirmation prompts could reveal unusual actions, such as an agent triggering an unrelated pipeline or reading a wiki in another project during a routine code review. Agents configured to execute calls without intervention remove that checkpoint and allow the injected sequence to proceed without human inspection.

Automated review systems create an even greater risk. Teams are beginning to launch AI-based review, triage, and summarization workflows in response to repository events. In those environments, no reviewer needs to manually start the interaction. A malicious pull request can trigger the agent automatically, allowing the injected instructions to run soon after the content is submitted.

The attack follows the same pattern demonstrated against GitHub’s MCP server in 2025, where malicious content in a public issue directed an agent to read information from a private repository and leak it through a pull request. Both cases combine access to confidential data, exposure to attacker-controlled content, and access to an outbound communication channel.

Microsoft described the behavior as part of a known category of AI risk and stated that exploitation requires an attacker with project write access and a second user who invokes an AI tool against the malicious content. The company recommended limiting project access and reviewing proposed changes before allowing an AI system to act.

Manual review offers limited protection in this case since HTML comments are not visible in the rendered Azure DevOps interface. A reviewer can inspect every visible line of a pull request description and still miss the injected payload. Detecting the content requires examining the raw Markdown, retrieving the description through the API, or scanning for concealed HTML comments.

As of July 21, 2026, no fixed release or CVE had been publicly announced. Version 2.8.0, released on June 24, remained the latest published version cited in the report. No public evidence indicated active exploitation outside Manifold Security’s testing.

Manifold tested the local server with personal access token authentication. The researchers assessed the weakness as a server-side code issue rather than a transport-specific flaw, suggesting that another deployment using the same vulnerable response path could face similar exposure. The hosted remote MCP server was not tested, and Microsoft did not publicly confirm whether it was affected.

Organizations using the Azure DevOps MCP server can reduce exposure by issuing project-scoped, least-privilege credentials to review agents. An agent reviewing code in one repository should not receive broad access to unrelated projects, internal wikis, administrative pipelines, or sensitive work items.

Tool availability should also match the task. A code-review agent may need repository read access and permission to comment on the pull request under review. It usually does not need the ability to trigger cross-project pipelines, retrieve unrelated wiki pages, or publish data through several external channels. Removing unnecessary tools reduces the number of actions an injected prompt can exploit.

Azure DevOps administrators can review agent traces for abnormal behavior during pull request analysis. Warning signs include cross-project repository queries, unexpected pipeline runs, unrelated wiki access, work-item searches outside the reviewed project, and comments containing information retrieved from another resource.

Teams can also scan pull request descriptions for HTML comments and other concealed Markdown elements before passing the content to an agent. Such filtering cannot stop every form of indirect prompt injection, but it can expose the delivery method used in this proof of concept.

Spotlighting can help models identify external content, yet it does not provide a complete security boundary. Models may still follow malicious instructions placed inside marked data, and inconsistent implementation leaves uncovered paths open to attack. Every tool response containing user-controlled data must receive the same treatment, and new server functions need review before release.

---

Adobe Patches CVSS 10.0 Campaign Classic Flaw Allowing Remote Code Execution

Adobe has released security updates for a maximum-severity vulnerability in Adobe Campaign Classic that could allow arbitrary code execution without requiring user interaction.

The vulnerability, tracked as CVE-2026-48449, received a CVSS score of 10.0. Adobe Campaign Classic is an enterprise marketing automation platform used to manage customer communications, campaigns, data workflows, and messaging operations across large organizations.

Adobe described CVE-2026-48449 as an incorrect authorization flaw. Successful exploitation could allow an attacker to execute arbitrary code within the security context of the affected user. The vulnerability does not require a victim to open a file, click a link, or complete another action, increasing the potential risk to exposed or poorly segmented systems.

Authorization flaws occur when an application fails to properly confirm whether a user, process, or request is permitted to perform a sensitive operation. In an enterprise campaign-management platform, a failure at this layer can provide access to functions that process data, execute workflows, interact with databases, or communicate with operating-system resources.

The Campaign Classic update also fixes CVE-2026-48448, a high-severity SQL injection vulnerability with a CVSS score of 8.6. According to Adobe, exploitation could allow an attacker to read arbitrary files from the underlying system.

SQL injection flaws arise when attacker-controlled input is incorporated into database queries without sufficient validation or parameterization. An attacker may be able to alter the intended query and access information outside the scope of the original request.

The arbitrary file-read impact associated with CVE-2026-48448 could expose configuration files, application credentials, database connection details, system information, customer records, or other data available to the Campaign Classic service account. The exact information accessible would depend on the affected deployment and the privileges assigned to the application.

The combination of code execution and arbitrary file access creates a serious risk for organizations running vulnerable Campaign Classic systems. An attacker who gains access through one weakness may be able to use the other to collect credentials, study the environment, establish persistence, or move into connected infrastructure.

Adobe addressed both vulnerabilities in Adobe Campaign Classic v7 version 7.4.3 build 9398 for Windows and Linux. Organizations running earlier builds should verify their installed version and apply the corrected release.

Adobe stated that it was not aware of either Campaign Classic vulnerability being exploited in active attacks at the time of disclosure. The absence of known exploitation does not remove the risk once technical details become public and attackers begin examining the affected software.

Campaign Classic deployments can hold access to customer databases, email infrastructure, campaign assets, analytics systems, and internal business workflows. Many installations also integrate with identity providers, customer relationship management platforms, file-transfer systems, web services, and other enterprise applications.

These connections can increase the impact of a compromise. Code execution within Campaign Classic may give an attacker access to more than the application itself, particularly when service accounts have broad permissions or shared credentials are stored in local configuration files.

Campaign management platforms may also be reachable by remote employees, vendors, agencies, and marketing teams across several business units. Organizations should review whether administrative interfaces or application services are exposed to the public internet and restrict access through network controls, virtual private networks, allowlists, or authenticated gateways.

Adobe also released updates for eight critical-rated vulnerabilities in Adobe Bridge. The flaws could allow arbitrary code execution or privilege escalation through weaknesses involving authorization checks, search paths, path traversal, and memory handling.

• CVE-2026-48395 received a CVSS score of 8.6 and was classified as an untrusted search path vulnerability leading to arbitrary code execution. These flaws can occur when an application loads a library, executable, or supporting file from a location that an attacker can control.
• CVE-2026-48396, also scored 8.6, involves incorrect authorization and could lead to arbitrary code execution. CVE-2026-48390 received the same score and could allow privilege escalation through another authorization failure.
• CVE-2026-48391 was assigned a CVSS score of 8.2 and stems from an untrusted search path condition that could permit arbitrary code execution.
• CVE-2026-48374 is a path traversal flaw with a CVSS score of 7.8. Path traversal vulnerabilities can allow an attacker to escape an expected directory and access or manipulate files in other parts of the system.

Adobe also corrected three out-of-bounds write vulnerabilities tracked as CVE-2026-48392, CVE-2026-48393, and CVE-2026-48394. Each received a CVSS score of 7.8 and could result in arbitrary code execution.

An out-of-bounds write occurs when software writes data outside the memory region assigned to a buffer. Attackers can sometimes use this condition to corrupt memory, crash the application, alter program execution, or run attacker-controlled code.

Security researcher Kieran, also known as “kaiksi,” reported CVE-2026-48390, CVE-2026-48391, CVE-2026-48395, CVE-2026-48396, and CVE-2026-48374. Researcher “yjdfy” reported CVE-2026-48392, CVE-2026-48393, and CVE-2026-48394.

Organizations using Adobe Campaign Classic or Adobe Bridge should inventory affected systems, confirm installed build numbers, and deploy the available patches. Systems processing sensitive customer information or operating with broad service-account permissions should receive priority.

Security teams should also review application logs, authentication records, database activity, file-access events, and process creation around Campaign Classic servers. Unexpected operating-system commands, unusual database queries, access to sensitive configuration files, or connections to unfamiliar external hosts could indicate suspicious activity.

After patching, administrators should assess the privileges assigned to Campaign Classic services and integration accounts. Reducing database rights, limiting file-system access, separating application tiers, and restricting outbound connections can reduce the impact of a future application compromise.

---

How Can Netizen Help?

Founded in 2013, Netizen is an award-winning technology firm that develops and leverages cutting-edge solutions to create a more secure, integrated, and automated digital environment for government, defense, and commercial clients worldwide. Our innovative solutions transform complex cybersecurity and technology challenges into strategic advantages by delivering mission-critical capabilities that safeguard and optimize clients’ digital infrastructure. One example of this is our popular “CISO-as-a-Service” offering that enables organizations of any size to access executive level cybersecurity expertise at a fraction of the cost of hiring internally. 

Netizen also operates a state-of-the-art 24x7x365 Security Operations Center (SOC) that delivers comprehensive cybersecurity monitoring solutions for defense, government, and commercial clients. Our service portfolio includes cybersecurity assessments and advisory, hosted SIEM and EDR/XDR solutions, software assurance, penetration testing, cybersecurity engineering, and compliance audit support. We specialize in serving organizations that operate within some of the world’s most highly sensitive and tightly regulated environments where unwavering security, strict compliance, technical excellence, and operational maturity are non-negotiable requirements. Our proven track record in these domains positions us as the premier trusted partner for organizations where technology reliability and security cannot be compromised.

Netizen holds ISO 27001, ISO 9001, ISO 20000-1, and CMMI Level III SVC registrations demonstrating the maturity of our operations. We are a proud Service-Disabled Veteran-Owned Small Business (SDVOSB) certified by U.S. Small Business Administration (SBA) that has been named multiple times to the Inc. 5000 and Vet 100 lists of the most successful and fastest-growing private companies in the nation. Netizen has also been named a national “Best Workplace” by Inc. Magazine, a multiple awardee of the U.S. Department of Labor HIRE Vets Platinum Medallion for veteran hiring and retention, the Lehigh Valley Business of the Year and Veteran-Owned Business of the Year, and the recipient of dozens of other awards and accolades for innovation, community support, working environment, and growth.

Looking for expert guidance to secure, automate, and streamline your IT infrastructure and operations? Start the conversation today.

---