CVE-2026-103572: Visual Studio Tools for Applications and SQL Server Management Studio Remote Code Execution Vulnerability
Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code over a network.
Other sources
Visual Studio Tools for Applications and SQL Server Management Studio Remote Code Execution Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.10.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.14.42
Event History
Frequently Asked Questions
Does exploitation require an authenticated account or elevated privileges?
No. The vector indicates network access, low attack complexity, and no privileges required. User interaction is required.
What is the likely impact if exploitation succeeds?
Successful exploitation can result in remote code execution with high impact to confidentiality, integrity, and availability.
Which listed products should be prioritized for review?
The affected software list identifies Microsoft Visual Studio 2022 and Microsoft Visual Studio 2026. The description also names Visual Studio Tools for Applications and SQL Server Management Studio, but no specific versions or configurations are provided.