Microsoft Visual Studio: Code injection leads to remote code execution

Summary

A code injection flaw (CWE-94) in the AI assistant integration (GitHub Copilot) of Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthenticated attacker to execute code over a network. Exploitation requires user interaction, for example if an attacker places malicious content in front of Copilot agent mode through indirect prompt injection. Microsoft and NVD rate the flaw CVSS 8.8 (High), while VulDB lists a lower score. Visual Studio is fixed in the October 13, 2026 update; a fixed SSMS build has not been confirmed.

Affected

• Visual Studio 2022 version 17.14: 17.14.0 to before 17.14.42
• Visual Studio 2026 version 18.10: 18.10.0 to before 18.10.4
• SQL Server Management Studio (SSMS): affected status unconfirmed; Microsoft has not named a fixed build

Fixed in

• Visual Studio 2022 version 17.14: 17.14.42
• Visual Studio 2026 version 18.10: 18.10.4
• SSMS: Unknown. No fixed build confirmed.
• Release date: October 13, 2026 (Patch Tuesday)

Workaround

No vendor-documented workaround. Microsoft recommends installing the update.

• Interim measure (researcher recommendation, not from Microsoft): disable Copilot agent mode and MCP server integrations in Visual Studio and SSMS until the fix is confirmed on each machine.
• Avoid opening untrusted repositories or files while Copilot agent mode is active.

Exploitation

• No active exploitation reported in the sources reviewed; CISA KEV was not checked.
• A public proof of concept exists according to the researcher's write-up, which demonstrates arbitrary command execution. No exploit details are included here.
• VulDB states that no exploit is available; this appears to be outdated.
• CISA SSVC: exploitation none, not automatable, total technical impact.

Our recommendation

• Install the October 13, 2026 updates on all developer and DBA workstations: Visual Studio 2022 17.14.42 or later, and Visual Studio 2026 18.10.4 or later.
• Inventory where Visual Studio and SSMS are installed and which versions are running.
• Until Microsoft confirms an SSMS fix, treat SSMS as unpatched and disable Copilot agent mode and MCP integrations there.
• Limit Copilot agent mode to trusted content and monitor for unexpected command execution from IDE processes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-103572 msrc.microsoft.com
• NVD entry via Vulners vulners.com
• Microsoft range data via Vulners (MS:CVE-2026-103572) vulners.com
• Researcher write-up (Embrace The Red) embracethered.com
• SecJuice coverage (SSMS coverage gap) secjuice.com
• VulDB entry (conflicting severity and exploit status) vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 19:23.