{"id":"CVE-2026-118147","kind":"vulnerability","aliases":["CVE-2026-118147"],"related":[],"title":"Visual Studio: improper certificate validation lets attackers spoof network connections","description":"Improper certificate validation in Visual Studio allows an unauthorized attacker to perform spoofing over a network.","summary":"Visual Studio does not properly validate certificates (CWE-295). An attacker who can sit in the network path (machine-in-the-middle, high complexity) can impersonate a trusted server and read or alter the traffic. Microsoft fixed it on Oct 30, 2026 in all four supported branches.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Visual Studio 2017 15.9","fixed":["15.9.84"],"affected":"< 15.9.84","ecosystem":"vendor"},{"name":"Visual Studio 2019 16.11","fixed":["16.11.62"],"affected":"< 16.11.62","ecosystem":"vendor"},{"name":"Visual Studio 2022 17.14","fixed":["17.14.44"],"affected":"< 17.14.44","ecosystem":"vendor"},{"name":"Visual Studio 2026 18.11","fixed":["18.11.3"],"affected":"< 18.11.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["mitm","other","spoofing","visual-studio","windows"],"not_affected_if":[],"how_to_check":"Open Help > About Microsoft Visual Studio (or the Visual Studio Installer) and compare your build to the fixed build for your branch: 2017 15.9.84, 2019 16.11.62, 2022 17.14.44, 2026 18.11.3. Anything lower is affected.","fix":"Update Visual Studio (not Windows) to at least 15.9.84, 16.11.62, 17.14.44 or 18.11.3 via the Visual Studio Installer.","status":"open","published_at":"2026-10-31T19:16:47+00:00","first_seen_at":"2026-10-31T19:27:36+00:00","triaged_at":"2026-10-31T19:28:31+00:00","updated_at":"2026-10-31T19:29:32+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-10-31T19:28:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Visual Studio: improper certificate validation lets attackers spoof network connections","impact":"medium","summary":"Visual Studio does not properly validate certificates in some network connections. An unauthorized attacker on the network can impersonate a trusted server.","audience":"developers","category":"other","nicknames":[],"who_cares":["visual-studio","windows"],"confidence":0.4,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker impersonates a trusted server on the network","analyst_note":"Sources give only the NVD description; check the Microsoft advisory for CVE-2026-118147 for affected versions, fixed builds and which connections are affected.","how_to_check":"- Check the installed Visual Studio version in Help > About Microsoft Visual Studio\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00059,"input_tokens":4060,"output_tokens":367,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources give only the NVD description; check the Microsoft advisory for CVE-2026-118147 for affected versions, fixed builds and which connections are affected.","search":"'-118147':13A,16A '-2026':12A,15A '-295':48B '15.9':20A '16.11':24A '17.14':28A '18.11':32A '2017':19A '2019':23A '2022':27A '2026':31A,82B '30':81B 'allow':94C 'alter':73B 'attack':7A,50B,97C 'branch':87B 'certif':4A,46B,89C 'complex':64B 'connect':10A 'cve':11A,14A 'cwe':47B 'fix':77B 'four':85B 'high':63B 'imperson':66B 'improp':3A,88C 'let':6A 'machin':59B 'machine-in-the-middl':58B 'microsoft':76B 'middl':62B 'mitm':33B 'network':9A,56B,103C 'oct':80B 'path':57B 'perform':99C 'proper':44B 'read':71B 'server':69B 'sit':53B 'spoof':8A,35B,100C 'studio':2A,18A,22A,26A,30A,38B,41B,93C 'support':86B 'traffic':75B 'trust':68B 'unauthor':96C 'valid':5A,45B,90C 'visual':1A,17A,21A,25A,29A,37B,40B,92C 'visual-studio':36B 'window':39B","nicknames":[],"mitigations":[],"who_affected":"Developer machines and build servers with Visual Studio 2017 15.9, 2019 16.11, 2022 17.14 or 2026 18.11 below the fixed build. Exploiting it needs an attacker in the network path between the IDE and the server it talks to, so shared or untrusted networks are the main risk. Machines without Visual Studio can skip it.","tier":"B","verified":{"fix":{"at":"2026-10-31T19:29:32Z","by":"analyst","doc":"https://learn.microsoft.com/en-us/visualstudio/releases/2026/release-notes","run_id":1258},"products":{"at":"2026-10-31T19:29:32Z","by":"analyst","doc":"https://learn.microsoft.com/en-us/visualstudio/releases/2026/release-notes","run_id":1258},"how_to_check":{"at":"2026-10-31T19:29:32Z","by":"analyst","doc":"https://learn.microsoft.com/en-us/visualstudio/releases/2026/release-notes","run_id":1258},"who_affected":{"at":"2026-10-31T19:29:32Z","by":"analyst","doc":"https://learn.microsoft.com/en-us/visualstudio/releases/2026/release-notes","run_id":1258}},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-31T19:16:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118147","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118147","severity":null,"published_at":"2026-10-31T19:16:47+00:00","modified_at":"2026-10-31T19:16:47+00:00","first_seen_at":"2026-10-31T19:27:36+00:00","fetched_at":"2026-10-31T19:27:36+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118147:1258","url":null,"severity":null,"published_at":"2026-10-31T19:29:32+00:00","modified_at":"2026-10-31T19:29:32+00:00","first_seen_at":"2026-10-31T19:29:32+00:00","fetched_at":"2026-10-31T19:29:32+00:00","note":"Read MSRC advisory: Important, CVSS 7.4, not exploited/not disclosed, 'Exploitation Less Likely'. Fixed builds 15.9.84 (VS2017; number from secondary listing, MSRC page build cell not shown), 16.11.62, 17.14.44, 18.11.3 (18.11.3 also on Learn release notes). A secondary site claims this is about eMudhra certificates; the MSRC page does not say so, so left out."}],"documents":[{"id":34498,"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118147","title":"MSRC: CVE-2026-118147 Visual Studio Spoofing Vulnerability","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":34499,"url":"https://learn.microsoft.com/en-us/visualstudio/releases/2026/release-notes","title":"Visual Studio 2026 release notes (18.11.3)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}