Updated: Azure DevOps (and Azure DevOps Server) and the log4j vulnerability

This post clarifies that Azure DevOps is not impacted by CVE-2025-68161 related to the Log4j vulnerability, as it does not use the vulnerable SocketAppender functionality. It confirms that Azure DevOps Search relies on local file and console appends only. Patches were released for Azure DevOps Server and TFS 2018.3.2 to upgrade Elasticsearch. For on-premises installations, specific actions are recommended for Azure DevOps Server 2020, 2019, and TFS 2018 if the Search feature is configured, including JVM upgrades and removal of the _JndiLookup_ class. TFS 2017 is not vulnerable to CVE-2021-44228 or CVE-2021-45046 but is dependent on an end-of-life Elasticsearch version, with recommendations to upgrade or uninstall Search. Linux Azure Pipelines agents are also confirmed to be unaffected by the Log4j vulnerabilities.