What is CVE-2026-103572?

CVE-2026-103572 is a security advisory published by Microsoft Security Response Center (MSRC) with High severity. Visual Studio Tools for Applications and SQL Server Management Studio Remote Code Execution Vulnerability

Which CVE IDs does CVE-2026-103572 cover?

CVE-2026-103572 covers the following CVE IDs: CVE-2026-103572. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of CVE-2026-103572?

CVE-2026-103572 has a CVSS v3 base score of 8.8, published by Microsoft Security Response Center (MSRC).

Which products are affected by CVE-2026-103572?

CVE-2026-103572 affects 2 products, including: Microsoft Visual Studio 2022 version 17.14; Microsoft Visual Studio 2026 version 18.10.

CVE-2026-103572HighCVSS 8.8

Visual Studio Tools for Applications and SQL Server Management Studio Remote Code Execution Vulnerability

Vendor

Microsoft Security Response Center (MSRC)

Published

October 13, 2026

Last Modified

—

🔗 CVE IDs covered (1)

CVE-2026-103572 →

📋 Description

Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code over a network.

🎯 Affected products2

Microsoft Visual Studio 2022 version 17.14
Microsoft Visual Studio 2026 version 18.10

✅ Remediation

KBRelease Notes (Security Update) — fixed build 18.10.4 KBRelease Notes (Security Update) — fixed build 17.14.42

🔗 References (1)

advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-103572