Visual Studio Copilot CVE-2026-103572: Trailing-Dot RCE

What to do

1. Update Visual Studio with the Visual Studio Installer to 17.14.42 or 18.10.4 or later, and confirm the version in Help > About.
2. Update SSMS to the latest 22.x release, since Microsoft's advisory does not name a fixed SSMS build.
3. Inventory fleet versions with vswhere -all -property catalog_productDisplayVersion.
4. Review .mcp.json and settings.VisualStudio.json in solutions and user profiles for MCP servers or a ripgrep path nobody added.
5. Until patched, keep Copilot agent mode away from untrusted repositories, files and MCP servers.

How to check if you are affected or compromised

• Look for MCP server entries in .mcp.json (repository or %USERPROFILE%\.mcp.json) and enabledMcpServers that nobody on the team added.
• Check settings.VisualStudio.json for a ripgrep path pointing at anything other than the bundled rg.exe.
• Hunt for unexpected child processes of devenv.exe or Ssms.exe, such as shells or binaries launched as MCP servers.

What happened#

On October 13, 2026 (Patch Tuesday), Microsoft fixed CVE-2026-103572, a code injection flaw (CWE-94) in the Copilot integration shared by Visual Studio and SQL Server Management Studio. Microsoft rates it Important, CVSS 3.1 8.8. Its FAQ explains the attack: an attacker "can deliver a malicious prompt remotely without prior access," and a user only has to interact with Copilot for the injected instructions to escalate into code execution.

Johann Rehberger, who reported it on August 4, published the technical details the same day. Copilot's agent should ask for confirmation before editing protected configuration files such as .mcp.json and settings.VisualStudio.json. The check, in Microsoft.VisualStudio.Copilot.Core.dll, compared file names as literal strings. Windows' Win32 layer drops a trailing period, so a write to .mcp.json. passed the check and still overwrote the real .mcp.json. Rehberger showed two ways to turn that into code execution:

• Add a malicious server to .mcp.json, enable it via enabledMcpServers, and let the IDE launch its command.
• In Visual Studio, point the ripgrep path setting in settings.VisualStudio.json at an arbitrary binary, which then runs whenever Copilot searches text.

The trigger is indirect prompt injection: instructions hidden in a file the developer opens, in repository content, or in output returned by an MCP server. Rehberger also reported a path traversal out of the trusted Extensions directory. His reading of the patch is that Microsoft added a GetFullPath call, which strips trailing dots and resolves .. before the check.

Who is affected#

Microsoft's update table and the CVE record list Visual Studio 2022 17.14 before 17.14.42 and Visual Studio 2026 18.10 before 18.10.4. The advisory title also names SSMS, which shares the Copilot code, but Microsoft gives no fixed SSMS build. The SSMS 22 release notes do not mention the CVE. SSMS 22.11.0, released October 13, moved to the Visual Studio 18.11.0 base, and 22.11.1 followed on October 20. NVD still shows the CVE as undergoing analysis.

Do you really need to act?#

Yes, on a normal fast cycle. Microsoft marks the CVE as not exploited and "Exploitation Less Likely", and CISA's enrichment says exploitation is "none." It is not in KEV. But the precondition is cheap: the attacker never touches the machine, only text that Copilot reads. With the write-up public (SecurityOnline covers the proof of concept), reproducing it is straightforward. The impact is code execution as the developer, which usually means source code, cloud credentials and signing keys. Teams that open third-party repositories or wire in community MCP servers should treat this as urgent.

What to do now#

1. Update Visual Studio through the Visual Studio Installer to 17.14.42 or 18.10.4 or later. For fleets, inventory versions with vswhere -all -property catalog_productDisplayVersion.
2. Update SSMS to the latest 22.x release, and keep checking Microsoft's advisory for an SSMS-specific build.
3. Review .mcp.json files in solutions and in %USERPROFILE%, plus settings.VisualStudio.json, for servers or a ripgrep path nobody added.
4. Until you're patched, keep Copilot agent mode away from untrusted repositories, files and MCP servers.

How to tell if you were hit#

Look for MCP server entries or enabledMcpServers changes that nobody on the team made, and for a ripgrep path in settings.VisualStudio.json that points anywhere other than the bundled binary. In EDR telemetry, look for unexpected children of devenv.exe or Ssms.exe, such as shells, scripting hosts or unknown binaries started as MCP servers. If you find any, treat the developer's credentials and tokens as exposed and rotate them.

Timeline#

• Aug 4, 2026 — Rehberger reports the path bypass to MSRC.
• Sep 16, 2026 — Microsoft confirms the vulnerability.
• Oct 13, 2026 — Patch Tuesday fix ships (17.14.42, 18.10.4). Rehberger publishes his write-up. SSMS 22.11.0 is released.
• Oct 16, 2026 — MSRC adds download and KB links. The fixed builds are unchanged.

Vulnerability records

• CVE-2026-103572 · Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Microsoft MSRC — CVE-2026-103572: Visual Studio Tools for Applications and SQL Server Management Studio RCE msrc.microsoft.com
2. CVE record — CVE-2026-103572 cve.org
3. NVD — CVE-2026-103572 nvd.nist.gov
4. Embrace The Red (Johann Rehberger) — Visual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572) embracethered.com
5. Microsoft Learn — Release notes for SQL Server Management Studio 22 learn.microsoft.com
6. SecurityOnline — CVE-2026-103572 Visual Studio Copilot RCE disclosed securityonline.info