CVE Alert: CVE-2026-118147 – Microsoft

Improper certificate validation in Visual Studio allows an unauthorized attacker to perform spoofing over a network.

Elevated risk to developer environments; urgent exploitation is not established because KEV and SSVC status are unavailable.

Successful spoofing could undermine trust in network communications used during development, potentially exposing sensitive information or steering developers towards attacker-controlled content. This creates a supply-chain concern, although the available data does not indicate direct code execution or system availability impact. Exploitation likelihood remains uncertain: PoC and EPSS data are also missing.

### Most likely attack path

An attacker would need a favourable network position or another way to influence traffic, making exploitation more demanding than a routine remote attack. No privileges or user action are required once those conditions are met. Scope is unchanged, so direct impact appears confined to the affected environment, though compromised developer trust can create downstream risk.

### Who is most exposed

Prioritise organisations with Visual Studio on developer workstations and build agents, especially where these systems access internal repositories or handle signing and release workflows.

Review proxy and DNS logs for unexpected destinations contacted by developer endpoints.

Investigate certificate-chain changes or TLS validation errors for development-related traffic.

Look for unusual outbound connections from Visual Studio or build processes.

Correlate developer reports of unexpected trust prompts or altered content with network events.

### Mitigation and prioritisation

Apply the vendor’s fixed update across affected installations; verify coverage, including less frequently used build agents.

Restrict developer and build-agent egress to approved destinations where practical.

Review proxy, DNS, and certificate-inspection controls for gaps that could permit traffic spoofing.

Pilot the update against essential extensions and build workflows, then deploy promptly with rollback plans.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.