We are releasing new patches for our self‑hosted product, Azure DevOps Server. We strongly recommend that all customers stay up to date with the latest, most secure version of Azure DevOps Server.
The most recent release, Azure DevOps Server, is available on the download page.
The following versions have been patched. For more details on these updates, see the release notes:
⬇️Azure DevOps Server Patch Download
| Version | Patch Download | Release Notes |
|---|---|---|
| Azure DevOps Server | Download Patch 9 | Release notes |
✅Verifying Installation
To verify that the patch is installed, run the following command on the Azure DevOps Server machine using the patch installer you downloaded:
<patch-installer>.exe CheckInstall
Replace <patch-installer> with the name of the patch file you downloaded. The command output will indicate whether the patch is installed.
Hi Gloridel,
We upgraded from Azure DevOps Server 2022.2 to 25H2 on June 12, 2026, using the re-published release (version 20.256.37104.1), and no patches have been installed yet.
Can you confirm that Patch 9 is cumulative for 25H2, meaning it includes the fixes from Patches 3 to 8, so we can install it directly without installing the earlier patches first?
Thank you,
Chaitanya
Hi Chaitanya, patches are cumulative. You can install Patch 9 directly without install previous patches.
Hi Microsoft
Our security scanning tools have identified CVE-2026-47691 and CVE-2026-45674 within the Azure DevOps Search Service installation.
The CVEs affect Netty DNS resolver components prior to version 4.1.135.Final and 4.2.15.Final due to insufficient validation of DNS NS records which may enable DNS cache poisoning. The affected component identified in the CVEs is netty-resolver-dns.
We have updated Azure DevOps Server to the latest available 25H2 build, however the Search Service still contains older Netty libraries in
C:\Program Files\Azure DevOps Server\Search\ES\elasticsearchv8.14\modules\repository-azure
Do you have any guidance on how we can remediate these CVEs?
Hi Nick, we’re reviewing the versions included with the Azure DevOps Server 25H2 Search Service to determine whether these CVEs are applicable and what remediation is appropriate.