Loading vulnerability…
Copilot Configuration-Write Bypass Leading to RCE in Visual Studio and SSMS
CVE-2026-103572 is a code-injection vulnerability affecting Microsoft Visual Studio Tools for Applications and SQL Server Management Studio, with demonstrated exploitation through Copilot in Visual Studio and SSMS. Protected-file validation in EditsFunctionHandler.GetEditConfirmationTypeAsync fails to account for Windows filename normalization. An attacker can use indirect prompt injection to induce Copilot to append a trailing period to a protected configuration filename, bypassing validation while Windows directs the write to the protected file. Unauthorized configuration changes can enable an attacker-controlled MCP server or replace the executable used for Copilot searches, resulting in arbitrary command execution. Related traversal variants can bypass expected confirmation for configuration access. Microsoft classified the vulnerability as Important, with a CVSS score of 8.8.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation converts attacker-controlled material processed by Copilot into unauthorized configuration changes and arbitrary command execution. Demonstrated consequences include launching a malicious MCP server in both Visual Studio and SSMS, and executing an attacker-selected search executable in Visual Studio. Related traversal variants permit access to settings and installation metadata without expected confirmation. The vulnerability does not independently establish privilege escalation; execution privileges depend on the IDE process and its environment.
If you can’t patch tonight, do this now.
No vendor-confirmed interim workaround is identified. Pending patch deployment, disabling affected Copilot functionality can interrupt the demonstrated attack chains. As defense in depth, restrict Copilot's exposure to untrusted project material and MCP responses, limit enabled MCP integrations, and review unexpected changes to MCP registrations and Copilot executable settings. These measures are not substitutes for the security update.
Patch, then assume compromise.
Apply the applicable Microsoft security updates released on October 13, 2026. The October Visual Studio update set includes Visual Studio 2022 version 17.14.42 and Visual Studio 2026 version 18.10.4; confirm the appropriate fixed release for the installed servicing branch. Obtain the corresponding SSMS or Visual Studio Tools for Applications update from Microsoft's CVE-specific guidance, since exact fixed versions for those products are not established here. The observed fix introduces GetFullPath-based normalization before path validation, addressing the trailing-period bypass and potentially related traversal variants.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.