CVE-2026-103572
High8.8Microsoft Visual Studio 2022 version 17.14: Visual Studio Tools for Applications and SQL Server Management Studio Remote Code Execution Vulnerabilitytitle from the CVE record
Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code over a network.
- CVSS
- 8.8v3.1
- EPSS (exploit probability)
- 1.0%62th pct
- CISA KEV
- Not listed
EPSS trendFIRST daily scores, last 90 days
Daily values
| Score date | EPSS | Percentile |
|---|---|---|
| 2026-10-26 | 1.0% | 62.4% |
| 2026-10-25 | 1.0% | 62.4% |
| 2026-10-24 | 0.8% | 56.9% |
| 2026-10-23 | 0.8% | 56.9% |
| 2026-10-22 | 0.8% | 56.9% |
| 2026-10-21 | 0.8% | 56.8% |
| 2026-10-20 | 0.8% | 56.6% |
| 2026-10-19 | 0.8% | 56.6% |
| 2026-10-18 | 0.8% | 56.5% |
| 2026-10-17 | 0.8% | 56.5% |
| 2026-10-16 | 0.8% | 56.5% |
| 2026-10-15 | 0.8% | 56.4% |
| 2026-10-14 | 0.8% | 56.4% |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Learn
Why it happened and what stops it
The weakness (CWE)
How attackers use it (ATT&CK)
Typical for this kind of weakness across CISA KEV exploits (CTID), not specific to this CVE.
How it's exploited
What the attacker gets
Controls that mitigate it (NIST SP 800-53)
- SI-4System MonitoringSystem and Information Integrity · mitigates 9 of these techniques
- CM-6Configuration SettingsConfiguration Management · mitigates 8 of these techniques
- SI-3Malicious Code ProtectionSystem and Information Integrity · mitigates 8 of these techniques
- AC-6Least PrivilegeAccess Control · mitigates 7 of these techniques
- AC-2Account ManagementAccess Control · mitigates 6 of these techniques
- AC-3Access EnforcementAccess Control · mitigates 6 of these techniques