Visual Studio vulnerabilities and fixes

CVEs that mention Visual Studio, ranked by priority. 16 tracked.

Visual Studio has 16 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 15. Most recent: 2026-10-13. Highest priority: CVE-2026-69320 (score 50/100).

• CVE-2026-69320 HIGH 8.8 UPGRADE Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Co
• CVE-2026-70336 HIGH 8.8 UPGRADE Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacke
• CVE-2026-59113 HIGH 8.8 UPGRADE Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
• CVE-2022-24513 HIGH 7.8 UPGRADE UPGRADE Visual Studio Elevation of Privilege Vulnerability
• CVE-2026-69306 HIGH 8.2 UPGRADE Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a securi
• CVE-2026-96957 HIGH 8.8 UPGRADE UPGRADE Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security
• CVE-2026-44189 HIGH 7.8 A flaw was found in the Visual Studio Code Ansible Lightspeed extension's AnsiblePlaybookRunProvider
• CVE-2026-47285 MEDIUM 6.5 UPGRADE Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allo
• CVE-2026-54981 HIGH 7.8 MITIGATE Inclusion of functionality from untrusted control sphere in Visual Studio Code - Python extension allows an un
• CVE-2026-65675 HIGH 7.1 MITIGATE No cwe for this issue in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to bypass a
• CVE-2026-70335 HIGH 7.8 UPGRADE Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot a
• CVE-2026-44190 HIGH 7.8 A flaw was found in the Ansible Lightspeed Visual Studio Code extension
• CVE-2026-44191 HIGH 7.8 A flaw was found in the Visual Studio Code Ansible Lightspeed extension
• CVE-2026-58650 HIGH 7.8 UPGRADE Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypa
• CVE-2026-69278 HIGH 7.8 UPGRADE Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature loc
• CVE-2026-44187 LOW 3.3 A flaw was found in the Ansible Lightspeed extension for Visual Studio Code

FAQ

How do I fix Visual Studio vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Visual Studio being exploited right now?

None of the tracked Visual Studio CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Visual Studio CVE should I patch first?

CVE-2026-69320 currently ranks highest (50/100): Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Co.

← Back to latest CVEs