Summary
Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
How could an attacker exploit this vulnerability?
The AV:N rating indicates the vulnerability is exploitable over the network, meaning an attacker can deliver a malicious prompt remotely without prior access, while UI:R means a user must interact with Copilot for exploitation to occur. Due to prompt injection, the system is coerced into executing attacker-controlled instructions, which can escalate into remote code execution (RCE) when the compromised prompt causes backend components or integrated tools to run unintended commands.
Security updates
18.10.4 — https://learn.microsoft.com/en-us/visualstudio/releases/2026/release-notes
17.14.42 — https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes
Vulnerabilities 1
-
High 8.8
Visual Studio Tools for Applications and SQL Server Management Studio Remote Code Execution Vulnerability
Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code over a network.
Revision history
-
#2
Updated the Security Updates table to add download and KB article links for Microsoft Visual Studio. This is an informational change only; the fixed builds are unchanged.
-
#1
Information published.
References
-
CVE-2026-103572 Visual Studio Tools for Applications and SQL Server Management Studio Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-103572
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss