Visual Studio and SSMS Copilot flaw CVE-2026-103572 allows code execution

What happened

Microsoft fixed CVE-2026-103572 in its 13 October 2026 Patch Tuesday release. The flaw sits in the GitHub Copilot integration shared by Visual Studio and SQL Server Management Studio (SSMS). Microsoft calls it a code injection issue with Remote Code Execution impact.

Security researcher Johann Rehberger of Embrace The Red found it, and Microsoft credits him. He reported it on 4 August 2026. Microsoft confirmed it on 16 September. He published his write-up on the patch date and says the report received no bounty.

According to Rehberger, Copilot was meant to be blocked from editing its own settings and tool configuration. A file name check could be bypassed. A hijacked Copilot could then change its configuration so the IDE runs a program of the attacker's choice.

Who is affected

Microsoft lists Visual Studio 2022 version 17.14 before 17.14.42. It also lists Visual Studio 2026 version 18.10 before 18.10.4. Developers who use GitHub Copilot in these IDEs are the exposed group.

Microsoft's title also names SSMS, and Rehberger says SSMS uses the same vulnerable Copilot component. Microsoft does not list a fixed SSMS build for this CVE. SSMS 22.11.0 was released the same day, but its notes do not mention this CVE.

What is confirmed

Microsoft scores the flaw CVSS 3.1 8.8 and rates it Important. NVD shows the Microsoft score and is still awaiting analysis. The weakness is CWE-94.

Microsoft's FAQ describes the preconditions. The attacker delivers a malicious prompt over the network and needs no prior access. A user must interact with Copilot. Prompt injection then makes Copilot follow attacker instructions, which can lead to code execution.

Untrusted content that Copilot reads, such as files in a project, is the likely carrier for that prompt. Microsoft marks the flaw as not publicly disclosed before release and not exploited. Its exploitability rating is "Exploitation Less Likely".

The CVE is not in the CISA KEV catalog. CISA's SSVC data on NVD records exploitation as none. BleepingComputer lists the CVE in its October 2026 Patch Tuesday roundup.

Researcher Johann Rehberger published a technical write-up with proof-of-concept demonstrations. In them, prompt injection leads Copilot to modify its protected config and launch a rogue MCP server. ThreatWire has not reproduced them. He says a trailing dot in a file name bypassed the protected-file check. He says Microsoft's fix normalizes paths (GetFullPath).

What is not confirmed

There is no report of exploitation in the wild. ThreatWire has not tested whether the demonstrations work on other setups.

The fixed SSMS version is not confirmed by Microsoft. ThreatWire found no dedicated coverage beyond BleepingComputer's Patch Tuesday table. ThreatWire has not checked the researcher's description of the fix.

What to do

Update Visual Studio 2022 to 17.14.42 or later. Update Visual Studio 2026 to 18.10.4 or later. Update SSMS to the latest release, and check Microsoft's page for an SSMS build entry.

Be careful when Copilot agent features process untrusted repositories or files. Review project MCP configuration and Visual Studio settings for servers or tool paths nobody added. Keep tool confirmations enabled.

Sources: Microsoft MSRC, NVD, CVE.org, the Visual Studio and SSMS release notes, Embrace The Red, and BleepingComputer. Links are in the references list.