Is Your Unpatched Visual Studio or SSMS Vulnerable to Network-Based Code Injection?

Microsoft has addressed a high-severity vulnerability in its development ecosystem that permits unauthorized remote code execution. The flaw, tracked as CVE-2026-103572, stems from improper control over code generation within Visual Studio Tools for Applications and SQL Server Management Studio. This issue allows attackers to execute arbitrary code over a network, posing a direct threat to systems running these tools without the latest security patches.

Root cause

The underlying issue is classified as code injection, specifically improper control of code generation. According to the National Vulnerability Database, this weakness aligns with CWE-94. Attackers can exploit this by manipulating how the application generates or handles code, bypassing intended security boundaries. This mechanism differs from the out-of-bounds read flaws in Windows Text Shaping that CloudSec Press reported on earlier in October 2026.

Attack path

An unauthorized attacker can exploit this vulnerability remotely over a network. The source material states that the flaw allows an unauthorized attacker to execute code over a network. It does not specify whether user interaction is required or not. By triggering the improper code generation process, the attacker gains the ability to execute malicious code on the target system. This remote vector significantly increases the risk profile for organizations exposing these tools to external networks.

Affected versions

• Microsoft Visual Studio 2022 version 17.14 before 17.14.42
• Microsoft Visual Studio 2026 version 18.10 before 18.10.4
• SQL Server Management Studio

Mitigation

• Update Visual Studio 2022 to version 17.14.42 or later.
• Update Visual Studio 2026 to version 18.10.4 or later.
• Apply the corresponding security update for SQL Server Management Studio.
• Restrict network access to development tools where possible.

What it means for organisations

Operations teams must immediately verify which development environments are exposed to untrusted networks. Security leads should assess whether legacy versions of Visual Studio or SSMS remain in production or staging areas. Suppliers providing managed development services need to confirm their toolchains are patched. Internal communications should alert developers to update their local installations. This ensures that the operational risk from remote code execution is minimized across all tiers of the software development lifecycle.

What to do and how to stay safe: Microsoft

• Inventory all instances of Visual Studio and SQL Server Management Studio to identify affected versions.
• Apply the latest security updates provided by Microsoft to patch the code injection flaw.
• Review network configurations to limit remote access to development tools and application servers.
• Monitor logs for unusual code execution patterns or unauthorized network connections to these tools.

Step-by-step guide: Patch Testing Best Practices That Prevent Production Failures

General security guidance from the CloudSec Press newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-103572?

The National Vulnerability Database rates the severity of CVE-2026-103572 as 8.8, which is classified as HIGH.

Which specific products are affected by this vulnerability?

The vulnerability affects Visual Studio Tools for Applications, SQL Server Management Studio, and specific versions of Visual Studio 2022 and 2026.

Is there a fix available for this remote code execution flaw?

Yes, Microsoft has released updates for Visual Studio 2022 and 2026 that resolve the improper code generation issue.