Developer tools belong in the trust review, too. A valid-looking network connection can still be the wrong connection.
New Microsoft advisory — October 30, 2026: CVE-2026-118147 describes improper certificate validation in Visual Studio that permits network spoofing. MSRC revision 1.0 is dated October 30 at 07:00 UTC; the linked fixed releases are dated October 29. Last verified: October 30.
Vendor facts: Important; published CVSS 3.1 base score 7.4 for the 2019, 2022 and 2026 rows (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). The 2017 row lacks a separate score in the retrieved CVRF. An attacker must gain a machine-in-the-middle position in the logical network path; successful exploitation can expose or alter sensitive information. Microsoft says Exploited: No, Publicly Disclosed: No, Exploitation Less Likely. Those are vendor assessments, not a guarantee. This CVE is absent from the full checked CISA KEV catalog; no federal KEV deadline applies.
Match the installed Visual Studio branch
Microsoft lists Visual Studio 2017 version 15.9 → 15.9.84; Visual Studio 2019 version 16.11 → 16.11.62; Visual Studio 2022 version 17.14 → 17.14.44; Visual Studio 2026 version 18.11 → 18.11.3. The CVRF does not publish complete lower affected-version bounds. Other channels and versions need vendor validation; do not assume an unlisted build is unaffected. These are IDE/product updates, not Windows cumulative KBs or evidence that every Windows endpoint is exposed.
Additional verified trust-path fix: Microsoft’s October 29 release notes for Visual Studio 2017 15.9.84 explicitly list CVE-2026-111497 (Brotli) and CVE-2026-92392 (libcurl HTTP/2 upload use-after-free), alongside CVE-2026-118147. This closes the earlier uncertainty about a released Visual Studio 2017 Brotli target; the older MSRC Brotli row still has no fixed-build value. It does not establish a universal fix for separately installed .NET, PowerShell or other embedded decoders. Brotli exposure requires an actual untrusted decompression path. CISA added the component CVE-2026-111497 to KEV October 27, with a November 10 federal deadline; that is not proof of Visual Studio-specific exploitation or a customer-specific obligation.
MSP action
Suggested priority: high where these tools are installed; urgent exposure review for an actual untrusted Brotli path. Inventory exact editions, branches and installed instances on developer/admin workstations and any build systems that actually contain them → restrict unnecessary untrusted network or decompression paths while arranging updates, without disabling TLS validation → use the branch-matched supported installer/update and refresh offline deployment layouts → restart as Microsoft requires and verify each running instance, certificate rejection/legitimate connectivity, extension and build/publish health. Suspicious interception or tampering warrants incident-response review; patching does not establish that a past incident is resolved. No complete CVE-specific workaround or blanket credential-rotation mandate was verified.
Official evidence
MSRC CVE-2026-118147; October CVRF and precise product rows.
Visual Studio 2017 15.9.84 · 2019 16.11.62 · 2022 17.14.44 · 2026 18.11.3 · Official CISA KEV mirror.