Microsoft Patches Copilot Prompt-Injection RCE in Visual Studio and SSMS (CVE-2026-103572)

Microsoft's October 13 Patch Tuesday fixed CVE-2026-103572, a remote code execution flaw in Visual Studio and SQL Server Management Studio (SSMS). Researcher Johann Rehberger (Embrace The Red) shows that a prompt injection could make Copilot write to protected IDE configuration files, because a filename with a trailing dot slipped past Copilot's path check. Microsoft rates it Important, CVSS 8.8, and lists it as not exploited.

What happened

On 13 October 2026 Microsoft published CVE-2026-103572 under the title "Visual Studio Tools for Applications and SQL Server Management Studio Remote Code Execution Vulnerability". The advisory classifies it as CWE-94 (code injection) with a Microsoft-assigned CVSS 3.1 base score of 8.8 (vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and a temporal score of 7.7.

Microsoft's advisory text does not mention Copilot by name in the description, but its FAQ explains the mechanism: the network attack vector means an attacker can deliver a malicious prompt remotely, and "user interaction required" means the user must interact with Copilot. Prompt injection then coerces the system into executing attacker-controlled instructions.

The technical detail comes from the researcher, who says he reported the issue on 4 August. By his account Microsoft confirmed it on 16 September, told him on 11 October that it was out of scope for a bounty ($0), and shipped the fix on 13 October. Those dates and the bounty outcome are his statements; Microsoft has not commented on them in the advisory. (We covered another Copilot bounty dispute over prompt injection on 11 October.)

Who is exposed

MSRC lists two affected product lines and their fixed builds:

The advisory title also names SSMS, and the researcher says the vulnerable code sits in a shared library, Microsoft.VisualStudio.Copilot.Core.dll, used by both Visual Studio and SSMS. MSRC's product table, however, lists only the two Visual Studio lines. Microsoft's own release notes for Visual Studio 17.14.42 and 18.10.4 (in their "Security Advisory Notices") list the CVE under a third name: "SSMS SQLtoolsMCPserver.exe Remote Code Execution Vulnerability".

SSMS 22.11.0 came out on 13 October 2026, and its notes say only "Updated to Visual Studio 18.11.0 [12306.390]"; they do not mention this CVE or a security fix. So the latest SSMS, 22.11.0, is the one to install, but Microsoft has not said it carries the fix. For context, SSMS 22.10.2 (28 September) made GitHub Copilot Agent Mode generally available in SSMS and bundles SQL Tools MCP server 3.0.17.

Visual Studio 2026 18.11.0 also shipped on 13 October. It is not in MSRC's table and its release notes have no Security Advisory section, so Microsoft has not said whether it includes the fix.

MSRC marks customer action as required and says the update needs a reboot.

How the bug works

Copilot's agent mode can edit files in a workspace, and it is supposed to ask the user before touching sensitive configuration files such as .mcp.json (which defines Model Context Protocol servers) or settings.VisualStudio.json. According to the researcher, the defect is in that check: EditsFunctionHandler.GetEditConfirmationTypeAsync compares the target filename against a list of protected names as a literal string.

Windows file APIs strip a trailing dot from a filename; that is documented behaviour, not the flaw. So a request to write .mcp.json. does not match the protected name .mcp.json, passes the check without a confirmation prompt ("the validation passes because the two strings are different", in the researcher's words), and then lands on the protected file anyway.

Attack chain as described by the researcher.

This is what makes prompt injection dangerous here. The attacker never runs code directly. They plant instructions in content the agent reads, such as a file in a repository or data returned by an MCP server, and the agent does the writing, as in the Ollama agent-mode approval bypass. Per the researcher, the injected instructions can:

• add or enable a malicious MCP server in the MCP configuration, which the IDE then launches; or
• in Visual Studio, change the ripgrepPath setting so that code search launches an arbitrary binary.

His demonstration opened the Windows calculator after the user interacted with a poisoned file, using Microsoft's MAI-Code-1-Flash model. He also describes two related weaknesses: paths that begin inside the trusted Extensions directory but use ..\ to resolve outside it, which let Copilot read SSMS.isolation.ini and the settings file without confirmation, and disclosure of an SSMS installation ID from SSMS.isolation.ini, which helps locate the SSMS settings path. We have not seen separate CVE assignments for these, and the MSRC record covers one CVE.

The researcher's reading of the patch is that Microsoft added a GetFullPath call, which normalises trailing dots and relative segments before the check runs. That is his analysis of the fixed code, not a Microsoft statement.

Is it being exploited?

The CVE is not in CISA's KEV catalogue (checked 14 October). MSRC reports the vulnerability as not exploited, with an exploitability assessment of "Exploitation Less Likely", and CISA's SSVC entry of 13 October records exploitation as "none". Those are point-in-time assessments, not a guarantee. MSRC also marks it as not publicly disclosed, although the researcher has published a full write-up with demonstration; treat the technique as public.

The CVSS temporal vector includes E:U (exploit code maturity unproven), which sits awkwardly beside a public write-up. We note the mismatch and draw no conclusion from it.

What defenders should do

1. Update Visual Studio. Move Visual Studio 2022 17.14 to 17.14.42 or later and Visual Studio 2026 18.10 to 18.10.4 or later, and reboot as MSRC requires. MSRC lists 18.10.4; Microsoft has not said whether 18.11.0, released the same day, includes the fix. Check the installed build in the Visual Studio Installer.
2. Find and update SSMS. Inventory SSMS installs, especially on DBA workstations, and move to SSMS 22.11.0 (13 October). Microsoft has not said which SSMS build carries the fix, so treat that as the best available step, not a confirmed one.
3. Review MCP and IDE config files. Look for unexpected entries in .mcp.json files in repositories and user profiles, and for a ripgrepPath in settings.VisualStudio.json that points anywhere other than the bundled search tool. These are the two outcomes the researcher describes; this is a hunting suggestion, not a Microsoft indicator list.
4. Limit what agents read. Treat repositories, issues and MCP server output you do not control as untrusted input to Copilot, and keep file-edit confirmation prompts on.
5. Remove MCP servers you do not recognise. Any server in a config file should be one a person added deliberately.

What is still unclear

• The fixed SSMS build. MSRC's table lists only Visual Studio, and the SSMS 22.11.0 notes do not mention the CVE.
• Whether Visual Studio 2026 18.11.0 includes the fix: MSRC lists 18.10.4; Microsoft has not said.
• Whether Microsoft's fix matches the researcher's description of GetFullPath normalisation. Microsoft has not published patch details.
• Whether the .. traversal and SSMS installation-ID issues were fixed under the same CVE or separately.
• Whether other Copilot surfaces that share the same library are affected beyond the products MSRC lists.

Sources

• MSRC advisory data for CVE-2026-103572 (read via the MSRC API)
• NVD record for CVE-2026-103572
• Embrace The Red: Visual Studio Copilot remote code execution
• Microsoft release notes: Visual Studio 2022, Visual Studio 2026 and SSMS 22