CVE-2026-103572
Awaiting Analysis
Awaiting Analysis - Queue
Code Injection in Visual Studio Tools for Applications
Vulnerability report for CVE-2026-103572, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-13
Last updated on: 2026-10-13
Assigner: Microsoft Corporation
Description
Description
Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code over a network.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Microsoft | Microsoft | Visual Studio 2022 version 17.14 17.14.0 |
| Microsoft | Microsoft | Visual Studio 2026 version 18.10 18.10.0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
