Visual Studio EUVD-2025-20538

| CVE-2025-49739 HIGH

Improper Link Resolution Before File Access (CWE-59)

2025-07-08 secure@microsoft.com

Authentication Bypass Microsoft Visual Studio Visual Studio 2017 Visual Studio 2019 Visual Studio 2022

8.8

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-59 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V5 - File Handling Symlink resolution safety
Impact	CVSS score of 8.8 (HIGH).

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

AnalysisAIv1 – Mar 16, 2026

Improper link resolution before file access ('link following') in Visual Studio allows an unauthorized attacker to elevate privileges over a network.

Earlier versions of this analysis (1)

v1 Mar 16, 2026 - 04:21 CVSS 8.8

RemediationAI

Monitor vendor advisories for patches. Apply mitigations such as network segmentation, access restrictions, and monitoring.

Affected VersionsENISA

Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) 15.9.0 <15.9.75

Microsoft Visual Studio 2022 version 17.10 17.10.0 <17.10.17

Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) 16.11.0 <16.11.49

Microsoft Visual Studio 2015 Update 3 14.0.0 <14.0.27564.0

Microsoft Visual Studio 2022 version 17.14 17.14.0 <17.14.8

Microsoft Visual Studio 2022 version 17.12 17.12.0 <17.12.10

Microsoft Visual Studio 2022 version 17.8 17.8.0 <17.8.23

Affected Packages

euvd microsoft_visual_studio_2015_update_3 fix: 14.0.27564.0

euvd microsoft_visual_studio_2017_version_15_9_includes_15_0_15_8 fix: 15.9.75

euvd microsoft_visual_studio_2019_version_16_11_includes_16_0_16_10 fix: 16.11.49

euvd microsoft_visual_studio_2022_version_17_10 fix: 17.10.17

euvd microsoft_visual_studio_2022_version_17_12 fix: 17.12.10

euvd microsoft_visual_studio_2022_version_17_14 fix: 17.14.8

euvd microsoft_visual_studio_2022_version_17_8 fix: 17.8.23

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 7 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Technical ContextAI · show details

This vulnerability is classified as Improper Link Resolution Before File Access (CWE-59).

Know when Visual Studio gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

3

Analysis Updated

Apr 16, 2026 - 06:28 EUVD-patch-fix

executive summary

Patch available

Apr 16, 2026 - 05:29 EUVD

15.9.75,17.10.17,16.11.49

CVE Published

Jul 08, 2025 - 17:16 nvd

HIGH 8.8

Executive ViewAI

Why It Matters

CVE-2025-49739 is a privilege escalation vulnerability in Visual Studio that allows attackers to exploit improper link resolution to gain elevated access over a network without requiring user authentication. This affects development teams and could compromise source code, build environments, and internal systems if Visual Studio instances are accessible on corporate networks.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.1%

Top 79% exploitable

Data Quality

4 sources

Confidence: Medium

EUVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

No

Human Impact

High

Priority Score

44

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

More in Visual Studio

View all

CVE-2026-102869 HIGH This Week

Type confusion (CWE-843) in Microsoft .NET and Visual Studio allows an unauthenticated remote attacker to elevate privil

CVE-2022-35827 HIGH This Week

Visual Studio Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi

CVE-2022-35826 HIGH This Week

Visual Studio Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi

CVE-2022-35825 HIGH This Week

Visual Studio Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi

CVE-2022-35777 HIGH This Week

Visual Studio Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi

CVE-2014-3802 MEDIUM This Month

msdia.dll in Microsoft Debug Interface Access (DIA) SDK, as distributed in Microsoft Visual Studio before 2013, does not

CVE-2023-24897 HIGH This Week

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulner

CVE-2021-28322 HIGH This Week

Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vu

CVE-2021-28321 HIGH This Week

Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vu

CVE-2021-28313 HIGH This Week

Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vu

CVE-2021-1680 HIGH This Week

Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerabil

CVE-2021-1651 HIGH This Week

Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerabil

Same weakness CWE-59 – Improper Link Resolution Before File Access

View all

CVE-2020-0787 HIGH POC

CVE-2015-1130 HIGH POC

CVE-2015-5287 HIGH POC

CVE-2026-41091 HIGH POC

CVE-2019-1069 HIGH POC

CVE-2026-81963 HIGH POC

CVE-2016-6664 HIGH POC

CVE-2025-60710 HIGH POC

Same technique Authentication Bypass

View all

CVE-2015-3306 CRITICAL POC

CVE-2023-22515 CRITICAL POC

CVE-2012-4681 CRITICAL POC

CVE-2013-2465 CRITICAL POC

CVE-2011-3544 CRITICAL POC

CVE-2022-40684 CRITICAL POC

CVE-2025-61882 CRITICAL POC

CVE-2024-0012 CRITICAL POC

References

Advisories & patches

ADVISORY https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49739 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-49739

Search Externally

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy