What is the CVSS score of EUVD-2025-20538?

EUVD-2025-20538 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Visual Studio 2017 are affected by EUVD-2025-20538?

CVE-2025-49739 is a privilege escalation vulnerability in Visual Studio that allows attackers to exploit improper link resolution to gain elevated access over a network without requiring user…. A patch is available.

How to fix or mitigate EUVD-2025-20538?

Within 24 hours: Inventory all Visual Studio installations across development and build infrastructure; disable network access to affected systems if possible. Within 7 days: Apply vendor-released patch to all Visual Studio instances-check Microsoft's security advisory for the specific patched version number and deploy via Windows Update or WSUS. Within 30 days: Conduct access logs review for any suspicious link resolution activity and verify no unauthorized privilege escalation occurred on patched systems.

Visual Studio 2017 EUVD-2025-20538

| CVE-2025-49739 HIGH

Improper Link Resolution Before File Access (CWE-59)

2025-07-08 secure@microsoft.com

Authentication Bypass Visual Studio 2017 Visual Studio Visual Studio 2022 Visual Studio 2019

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:28 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

15.9.75,17.10.17,16.11.49

EUVD ID Assigned

Mar 16, 2026 - 04:21 euvd

EUVD-2025-20538

Analysis Generated

Mar 16, 2026 - 04:21 vuln.today

CVE Published

Jul 08, 2025 - 17:16 nvd

HIGH 8.8

DescriptionCVE.org

Improper link resolution before file access ('link following') in Visual Studio allows an unauthorized attacker to elevate privileges over a network.

Analysis

Improper link resolution before file access ('link following') in Visual Studio allows an unauthorized attacker to elevate privileges over a network.

Technical ContextAI

This vulnerability is classified as Improper Link Resolution Before File Access (CWE-59).

RemediationAI

Monitor vendor advisories for patches. Apply mitigations such as network segmentation, access restrictions, and monitoring.

More in Visual Studio 2017

View all

CVE-2020-1147 HIGH Act Now POC

7.8 Jul 14

A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the softwar

CVE-2018-0952 HIGH This Week POC

7.8 Aug 15

An Elevation of Privilege vulnerability exists when Diagnostics Hub Standard Collector allows file creation in arbitrary

CVE-2020-26870 MEDIUM This Month POC

6.1 Oct 07

Cure53 DOMPurify before 2.0.17 allows mutation XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exp

CVE-2022-35827 HIGH This Week

8.8 Aug 09

Visual Studio Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi

CVE-2022-35826 HIGH This Week

8.8 Aug 09

Visual Studio Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi

CVE-2022-35825 HIGH This Week

8.8 Aug 09

Visual Studio Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi

CVE-2022-35777 HIGH This Week

8.8 Aug 09

Visual Studio Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi

CVE-2020-1416 HIGH This Week

8.8 Jul 14

An elevation of privilege vulnerability exists in Visual Studio and Visual Studio Code when they load software dependenc

CVE-2019-1113 HIGH This Week

8.8 Jul 15

A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a fi

CVE-2019-0613 HIGH This Week

8.8 Mar 05

A remote code execution vulnerability exists in .NET Framework and Visual Studio software when the software fails to che

CVE-2023-36897 HIGH This Week

8.1 Aug 08

Visual Studio Tools for Office Runtime Spoofing Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem

CVE-2024-43590 HIGH This Week

7.8 Oct 08

Visual C++ Redistributable Installer Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerab

Same weakness CWE-59 – Improper Link Resolution Before File Access

View all

CVE-2015-1130 HIGH POC

7.8

CVE-2026-41091 HIGH POC

7.8

CVE-2016-6664 HIGH POC

7.0

CVE-2025-60710 HIGH POC

7.8

CVE-2024-57728 HIGH POC

7.2

CVE-2025-21391 HIGH

7.1

CVE-2025-48384 HIGH

8.0

CVE-2024-28189 CRITICAL POC

10.0

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2012-1723 CRITICAL POC

9.8

CVE-2017-10271 HIGH POC

7.5

CVE-2015-1427 CRITICAL POC

9.8

CVE-2025-3248 CRITICAL POC

9.8

EUVD-2025-20538 vulnerability details – vuln.today

Back

Visual Studio 2017 EUVD-2025-20538

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

Analysis

Technical ContextAI

RemediationAI

More in Visual Studio 2017

Same weakness CWE-59 – Improper Link Resolution Before File Access

Same technique Authentication Bypass

Share

External POC / Exploit Code