We are releasing new patches for our self‑hosted product, Azure DevOps Server. We strongly recommend that all customers stay up to date with the latest, most secure version of Azure DevOps Server.
The most recent release, Azure DevOps Server, is available on the download page.
The following versions have been patched. For more details on these updates, see the release notes:
⬇️Azure DevOps Server Patch Download
| Version | Patch Download | Release Notes |
|---|---|---|
| Azure DevOps Server | Download Patch 9 | Release notes |
✅Verifying Installation
To verify that the patch is installed, run the following command on the Azure DevOps Server machine using the patch installer you downloaded:
<patch-installer>.exe CheckInstall
Replace <patch-installer> with the name of the patch file you downloaded. The command output will indicate whether the patch is installed.
Does anyone else also see constant Blocked runs of GitAdvSecCommitScanningJob on the Azure DevOps Monitoring page: /tfs/_oi/_jobmonitoring
https://developercommunity.visualstudio.com/t/GitAdvSecCommitScanningJob-blocked/10709401
It sort of makes sense that it is blocked, as Azure DevOps Server does not support Git Advanced Security, but why does it try to run it at all?
Hi Gloridel,
We are currently running Azure DevOps Server 2022.2 and our security assessment requires Apache Log4j version 2.25.4 or later. However, the Elasticsearch version bundled with Azure DevOps Server Search appears to use an older Log4j version (2.17.x).
We would like to clarify the following:
1. Is there an officially supported Azure DevOps Server Search package or update that includes Elasticsearch with Log4j 2.25.4 or later?
2. Does Microsoft have plans to update the bundled Elasticsearch and Log4j dependencies for Azure DevOps Server 2022.2?
3. Can Elasticsearch 8.19.23 be used with Azure DevOps Server 2022.2 Search, or is this configuration explicitly...
Hi Poh Yee, using a different Elasticsearch version, including Elasticsearch 8.19.23, is not a supported configuration and can cause the Azure DevOps Server Search installation to fail. We therefore do not recommend independently replacing or upgrading the bundled Elasticsearch components.
For the security compliance question, could you share the specific Log4j CVE(s) that your security tooling is flagging? We need the CVE numbers to determine whether the bundled version and its usage in Azure DevOps Server Search are affected and to provide the appropriate remediation guidance.
Apache Log4j 2.13.1 < 2.25.5 / 2.26.0 < 2.26.1 Improper JSON Serialization (CVE-2026-49844), is this enough? do let me know if you need more from my side, thankss
Has the VSBuild, VSTest, MSTest issue been resolved? I haven't seen it mentioned since April comments that it was coming during quarter 3. We're now in quarter 4 with no updates. The generic monthly release notes posts don't mention anything. The specific monthly release notes posts (Server, Server 2022) also don't mention anything. Right now we're surviving on the third-party plugin/releases/repackaging from jessehouwing. It would be nice if Microsoft would say "yes that's the supported method for now" or "upgrade to version XYZ that has the support you're looking for" or some other useful, official clarification.
We (and others) pay for...
This is the answer: Upgrade to 26H2: https://devblogs.microsoft.com/devops/azure-devops-server-rc-26h2-is-now-available/?commentid=5522#comment-5522
Hi Gloridel,
We upgraded from Azure DevOps Server 2022.2 to 25H2 on June 12, 2026, using the re-published release (version 20.256.37104.1), and no patches have been installed yet.
Can you confirm that Patch 9 is cumulative for 25H2, meaning it includes the fixes from Patches 3 to 8, so we can install it directly without installing the earlier patches first?
Thank you,
Chaitanya
Hi Chaitanya, patches are cumulative. You can install Patch 9 directly without install previous patches.