CVE-2026-103572

Visual Studio Tools for Applications and SQL Server Management Studio Remote Code Execution Vulnerability

HIGH 8.8EPSS 0.8%

Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code over a network.

Affected: Microsoft · Microsoft Visual Studio 2022 version 17.14 · Microsoft Visual Studio 2026 version 18.10
CVSS v3.1 MICROSOFT: 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS: 0.82% chance of exploitation in the next 30 days, 57th percentile
Published: 2026-10-13
Updated: 2026-10-16

Proof-of-concept exploits (1)

themsquared/agent-config-guard-bypass0★ · 2026-10-14

References

CVE Record
NVD entry