CVE-2026-118147: Visual Studio Spoofing Vulnerability
Improper certificate validation in Visual Studio allows an unauthorized attacker to perform spoofing over a network.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.11.62 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.9.84 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.11.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.14.44
Event History
Frequently Asked Questions
Which Visual Studio releases are listed as affected?
The affected software list includes Microsoft Visual Studio 2017, Visual Studio 2019, Visual Studio 2022, and Visual Studio 2026.
Does exploitation require an authenticated account or user interaction?
No. The vector indicates network exploitation with no privileges required and no user interaction required.
What conditions make exploitation less straightforward?
The attack complexity is rated high, meaning successful exploitation requires conditions beyond simply reaching a vulnerable instance over the network.
What impact could successful exploitation have?
Successful spoofing can have high confidentiality and high integrity impact. No availability impact is indicated.