Live › vulnerability › CVE-2026-118147
Visual Studio does not properly validate certificates (CWE-295). An attacker who can sit in the network path (machine-in-the-middle, high complexity) can impersonate a trusted server and read or alter the traffic. Microsoft fixed it on Oct 30, 2026 in all four supported branches.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 19:27 UTC. All times on this page are UTC.
Developer machines and build servers with Visual Studio 2017 15.9, 2019 16.11, 2022 17.14 or 2026 18.11 below the fixed build. Exploiting it needs an attacker in the network path between the IDE and the server it talks to, so shared or untrusted networks are the main risk. Machines without Visual Studio can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Visual Studio 2017 15.9 | vendor | < 15.9.84 | 15.9.84 |
| Visual Studio 2019 16.11 | vendor | < 16.11.62 | 16.11.62 |
| Visual Studio 2022 17.14 | vendor | < 17.14.44 | 17.14.44 |
| Visual Studio 2026 18.11 | vendor | < 18.11.3 | 18.11.3 |
15.9.84, 2019 16.11.62, 2022 17.14.44, 2026 18.11.3Update Visual Studio (not Windows) to at least 15.9.84, 16.11.62, 17.14.44 or 18.11.3 via the Visual Studio Installer.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper certificate validation in Visual Studio allows an unauthorized attacker to perform spoofing over a network.
This page as .md · .json · in your agent: get_signal("CVE-2026-118147")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.