Patch Forecast
Amber warning
Patch this week.

CVE-2026-103572

Microsoft: code injection

Risk score
74/100
CVSS
8.8 v3.1
Exploit chance (30 days)
0.8%
Published
13 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code over a network.
Affected
Microsoft
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: MicrosoftTHE FLAWSTHE FIXCVE-2026-103572Code injectionCVSS 8.8 · EPSS 1%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedMicrosoftAMBER · PATCH THIS WEEKMicrosoftImproper control of generationof code ('code injection') inVisual Studio Tools forApplications and SQL ServerManagement Studio allows anunauthorized attacker toexecute code over a network.Where it standsNo known exploitation1 outlet covering itHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.13 Oct · Embrace The RedVisual Studio Copilot and SSMS Remote CodeExecution (CVE-2026-103572)16 Oct · Microsoft Security Response CenterCVE-2026-103572 Visual Studio Tools forApplications and SQL Server Management StudioRemote Code Execution VulnerabilityCONNECTS TOSame weaknessCode injection (CWE-94)239 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Microsoft: Amber, patch this week. Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code over a network.

The flaws

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Microsoft

Where it stands

  • No known exploitation
  • 1 outlet covering it

How it unfolded

  1. 13 Oct, Embrace The Red (press): Visual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)
  2. 16 Oct, Microsoft Security Response Center (official): CVE-2026-103572 Visual Studio Tools for Applications and SQL Server Management Studio Remote Code Execution Vulnerability

Connects to

In the news

TL;DR

Microsoft patches Visual Studio Copilot and SSMS vulnerability (CVE-2026-103572) allowing remote code execution.

  • Microsoft classified it as Important severity Remote Code Execution vulnerability.
  • The vulnerability allows Copilot to escape containment restrictions and achieve arbitrary command execution.
  • No information on exploitation in the wild or scale.
  • SecurityWeek reports that the vulnerability affects Visual Studio Tools for Applications as well.

AI summary of 1 article.

Why it is Amber

  • CVSS 8.8 high
  • Remotely exploitable without logging in
  • Named in a government or vendor bulletin

Government and vendor bulletins

References

Original description

Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code over a network.

Last activity 16 Oct 2026. Patch Forecast updates every hour.