Spoofing Vulnerability in Visual Studio by Microsoft
CVE-2026-118147

7.4HIGH

Key Information:

Vendor: Microsoft
Status: Microsoft Visual Studio 2017 Version 15.9; Microsoft Visual Studio 2019 Version 16.11; Microsoft Visual Studio 2022 Version 17.14; Microsoft Visual Studio 2026 Version 18.11
Vendor: CVE Published:; 31 October 2026

What is CVE-2026-118147?

An improper certificate validation issue in Visual Studio allows unauthorized attackers to execute spoofing attacks on networks, potentially compromising sensitive data and service integrity. Addressing this vulnerability is essential to maintain secure communications and protect user authenticity during system operations.

Affected Version(s)

Microsoft Visual Studio 2017 version 15.9 15.9.0 < 15.9.84

Microsoft Visual Studio 2019 version 16.11 16.11.0 < 16.11.62

Microsoft Visual Studio 2022 version 17.14 17.14.0 < 17.14.44

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...

vendor-advisorypatch

CVSS V3.1

Score:

7.4

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

High

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 31, 2026
Vulnerability Reserved
Oct 27, 2026

CVE-2026-118147 Data

JSON