Microsoft Visual Studio CVE-2026-118147

Exploitation requires improper certificate validation in Visual Studio to be triggered over a network, which per the CVSS high attack complexity (AC:H) realistically requires the attacker to hold an intercepting/man-in-the-middle position on the network path between the IDE and a remote server so a forged or invalid certificate can be offered; the available sources do not describe the precise trigger beyond this. No authentication is required (PR:N) and no user interaction is required (UI:N), but the need for a privileged network position and the high complexity meaningfully limit opportunistic, widespread exploitation. Affected and requiring update are Visual Studio 2017 version 15.9, 2019 version 16.11, 2022 version 17.14, and 2026 version 18.11; applying the vendor update is the remediation indicated by the evidence (official fix available).

This is a moderate-priority issue rather than a drop-everything emergency, and the signals are internally consistent. The CVSS 3.1 base score of 7.4 derives from a network vector with no privileges and no user interaction (AV:N/PR:N/UI:N) but high attack complexity (AC:H), with high confidentiality and integrity impact and no availability impact (C:H/I:H/A:N). The temporal metrics reinforce a lower real-world urgency: Exploit Code Maturity is Unproven (E:U), an Official fix is available (RL:O), and Report Confidence is Confirmed (RC:C). No CISA KEV listing and no EPSS score are provided, and no public exploit is referenced, so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_week', which aligns with a patch-available, not-actively-exploited certificate-validation flaw. The AC:H metric indicates a non-trivial precondition - typically an attacker needing a privileged network (man-in-the-middle) position - but the available sources do not describe the precise trigger, so the mechanism behind AC:H should be treated as unconfirmed. There is no conflict between the signals; the main gap is the absence of EPSS and the lack of any technical detail beyond the one-line NVD description.

An attacker who can intercept network traffic between a developer's Visual Studio instance and a remote endpoint (for example on a shared or compromised network) presents a fraudulent or invalid TLS certificate that Visual Studio fails to properly validate, allowing the attacker to impersonate a trusted server. This enables spoofing of the trusted connection, potentially exposing or altering data exchanged during the session. No public exploit is identified at time of analysis, and the exploit code is rated Unproven (E:U).