What is the CVSS score of CVE-2026-47305?

CVE-2026-47305 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Visual Studio are affected by CVE-2026-47305?

Microsoft Visual Studio versions 17.12, 17.14 (2022) and 18.7 (2026) contain a local code execution vulnerability allowing attackers to run arbitrary code when developers open or interact with…. A patch is available.

How to fix or mitigate CVE-2026-47305?

Within 24 hours, inventory all instances of affected Visual Studio versions (2022 versions 17.12 and 17.14, 2026 version 18.7) and communicate risk to development teams with guidance to avoid opening untrusted projects pending remediation. Within 7 days, deploy the vendor-released patch to all affected Visual Studio installations organization-wide. Within 30 days, complete verification that all targeted instances are running patched versions and document any systems unable to patch with alternative controls documented.

Visual Studio CVE-2026-47305

EUVD-2026-44356 HIGH

Protection Mechanism Failure (CWE-693)

2026-07-14 microsoft

GHSA-5q8c-4c69-36xr

Authentication Bypass Microsoft Microsoft Visual Studio 2022 Version 17 12 Microsoft Visual Studio 2022 Version 17 14 Microsoft Visual Studio 2026 Version 18 7

7.8

CVSS 3.1 · Vendor: microsoft

Temporal: 6.8

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

6.8 MEDIUM

cvss

vuln.today AI

7.8 HIGH

Local IDE flaw requiring the victim to open crafted content (AV:L, UI:R) with no prior privileges (PR:N), yielding full local code execution and high C/I/A in an unchanged scope.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 20:09 vuln.today

CVE Published

Jul 14, 2026 - 18:45 nvd

HIGH 7.8

DescriptionCVE.org

Protection mechanism failure in Visual Studio allows an unauthorized attacker to execute code locally.

AnalysisAI

Local code execution in Microsoft Visual Studio (2022 versions 17.12 and 17.14, and 2026 version 18.7) stems from a protection mechanism failure that lets an unauthorized attacker run arbitrary code once a victim is convinced to open or interact with a malicious project, file, or solution. Microsoft has published a fix, but there is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV. The CVSS 3.1 base score is 7.8, reflecting high confidentiality, integrity, and availability impact requiring local access plus user interaction.

Technical ContextAI

Visual Studio is Microsoft's flagship integrated development environment for building .NET, C++, web, and cloud applications, widely used on developer workstations and build agents. The root cause is CWE-693 (Protection Mechanism Failure), meaning a built-in security control - the vendor's supplied tags describe it as an Authentication Bypass - fails to enforce its intended trust boundary, allowing untrusted code or content processed by the IDE to bypass safeguards and execute. The affected CPEs precisely identify microsoft:microsoft_visual_studio_2022_version_17.12, microsoft_visual_studio_2022_version_17.14, and microsoft_visual_studio_2026_version_18.7, indicating the defect spans both the 2022 servicing branches and the newer 2026 release rather than a single build.

RemediationAI

Patch available per vendor advisory: apply the servicing update for your channel from the MSRC guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47305, which covers Visual Studio 2022 17.12, 2022 17.14, and 2026 18.7 - install the update through the Visual Studio Installer or your managed update process and confirm the build number matches the advisory's fixed version. Until patched, reduce exposure by treating untrusted solutions, projects, and source files as hostile: do not open repositories, .sln/.csproj, or downloaded samples from untrusted origins, and disable automatic project/asset loading and 'Trust' prompts so no build or restore action runs on open. Isolate developer machines and build agents that cannot be immediately updated (restricted network segment, least-privilege service accounts) to limit blast radius; the trade-off is added friction opening legitimate external repos, which is acceptable given the code-execution impact.