Skip to content
CVE-2026-118147: Microsoft Visual Studio Spoofing Vulnerability

CVE-2026-118147: Microsoft Visual Studio Spoofing Vulnerability

First seen 1 Nov 2026, 13:48 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 1, 2026 at 15:16 UTC
  • •CVE-2026-118147 allows network spoofing via improper certificate validation in Visual Studio.
  • •High attack complexity requires attackers to be positioned in the network path.
  • •No active exploitation or proof-of-concept code reported as of now.

CVE-2026-118147 was published on October 31, 2026, detailing an improper certificate validation flaw in Microsoft Visual Studio that allows unauthorized attackers to perform network spoofing. This vulnerability poses a high risk to developer environments, particularly those using Visual Studio 2017 version 15.9. Attackers must position themselves within the network path to exploit this flaw, indicating a high attack complexity. While the vulnerability could lead to significant confidentiality and integrity loss, it does not affect availability. Organizations using Visual Studio for development and build processes are advised to prioritize patching and review their network traffic for anomalies. As of now, there is no evidence of or proof-of-concept code available.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-30
CVE-2026-118147 published
Microsoft disclosed a vulnerability in Visual Studio that could allow network spoofing due to improper certificate validation.
Api.Msrc.Microsoft
2026-10-31
CVE-2026-118147 added to CVE database
CVE-2026-118147 was officially published with a CVSS score of 7.4, indicating a high severity level.
Api.Msrc.Microsoft

More articles in this cluster (2)

Following this threat?

Track CVE-2026-118147 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (5)

1 / 4

Common questions

Which versions of Visual Studio are affected?
The vulnerability affects Microsoft Visual Studio 2017 version 15.9.
Is there any active exploitation of this vulnerability?
No, there is currently no evidence of active exploitation reported.
What should organizations do to mitigate this risk?
Organizations should apply the vendor's fixed update and review their network traffic for any anomalies.