Unpatched Visual Studio Instances Face High-Severity Remote Code Execution Risk

Microsoft has published details regarding CVE-2026-103572, a high-severity remote code execution vulnerability. The flaw stems from improper control over code generation, specifically code injection, within Visual Studio Tools for Applications and SQL Server Management Studio. According to the official advisory, an unauthorized attacker can exploit this weakness to execute arbitrary code over a network. This capability grants significant control to adversaries who can craft the necessary inputs.

Which products are affected by this vulnerability?

The vulnerability impacts specific ranges of Microsoft Visual Studio. According to the NVD record, Microsoft Visual Studio 2022 versions 17.14 before 17.14.42 are affected. Additionally, Microsoft Visual Studio 2026 versions 18.10 before 18.10.4 remain vulnerable. Organizations using these specific versions must verify their current installations against these cutoff points. No other versions or products are listed in the source material as being at risk from this specific CVE.

How severe is the technical risk?

The National Vulnerability Database assigns a CVSS score of 8.8 to this flaw, categorizing it as high severity. The weakness is classified under CWE-94, which denotes improper control of generation of code. This classification aligns with the advisory’s description of code injection. The high score reflects the potential for remote code execution by an unauthorized attacker over a network, as described in the source material.

What is the context for this release?

This advisory follows recent disclosures of significant vulnerabilities in development and infrastructure tools. As Sandbox Desk reported on 2026-10-14, Juniper SRX devices faced a critical unauthenticated root code execution risk via GRE tunnels. On the same date, the outlet highlighted a critical remote code execution risk in unpatched Windows systems due to a CCFFilter driver flaw. These reports underscore a period of heightened risk for software infrastructure and development environments.

What immediate actions should developers take?

Developers should audit their environments for the affected versions of Visual Studio 2022 and 2026. Teams must identify instances running versions prior to 17.14.42 or 18.10.4 respectively. Once identified, these systems should be updated to the patched versions immediately to mitigate the risk of remote code execution. Until updates are applied, limiting network access to these tools can reduce exposure to untrusted inputs.

What analysts watch for

Analysts typically monitor for unusual process creation within the Visual Studio environment, particularly when initiated by unexpected parent processes. They examine network logs for inbound connections targeting ports associated with these development tools. Persistence mechanisms often involve the creation of new user accounts or the modification of registry keys. Investigators look for signs of privilege escalation attempts following initial code execution. Teams usually check whether legitimate development workflows have been hijacked to deploy secondary payloads or exfiltrate sensitive data.

Background: National Vulnerability Database

The National Vulnerability Database lists known flaws but lacks deployment context. Do not treat every entry as an immediate emergency. Cross-reference findings with your asset inventory and usage patterns to determine real risk, rather than reacting to every new identifier.

Read the full guide: National Vulnerability Database: Five Common Misreadings and Fixes

What to do and how to stay safe: Microsoft

• Verify the installed version of Visual Studio 2022 and 2026 against the affected ranges.
• Apply the latest updates to reach version 17.14.42 or 18.10.4 respectively.
• Monitor network traffic for unauthorized attempts to connect to development tools.
• Review logs for unexpected code execution or process spawning within these applications.

Step-by-step guide: How Vulnerability Scanning Works: The Hidden Mechanics and Limits

General security guidance from the Sandbox Desk newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-103572?

The vulnerability has a CVSS score of 8.8, which is classified as high severity.

Which versions of Visual Studio 2022 are vulnerable?

Versions 17.14 before 17.14.42 are affected by this code injection flaw.

Does this vulnerability require authentication?

No, the advisory states that an unauthorized attacker can execute code over a network.