CVE-2026-103572: Visual Studio Copilot and SSMS RCE Explained

CVE-2026-103572 is a high-severity remote code execution vulnerability affecting Copilot-related components shared by Microsoft Visual Studio and SQL Server Management Studio. について Microsoft CVE record dates disclosure to October 13, 2026 and shipped fixes the same day. This is a follow-up analysis for AI security teams, not a new November zero-day.

について Microsoft CVE record assigns CVSS 3.1 8.8 and classifies the issue as CWE-94, improper control of code generation. The affected Visual Studio ranges are 17.14.0 through versions before 17.14.42, and 18.10.0 through versions before 18.10.4. The attack requires user interaction according to the CVSS vector. Microsoft’s record describes network-reachable code execution; the original researcher explains how untrusted content influencing the Copilot agent could reach the vulnerable file-write behavior.

CVE-2026-103572 at a glance

The security boundary was more than “can the agent write a file?”

Copilot needs bounded file access to help edit projects. Some files are different because they control what the IDE launches. The original researcher’s technical write-up found that the protected-filename check compared path strings before Windows had reduced them to the path actually used for the write.

として researcher’s path-validation analysis demonstrates, a name such as .mcp.json. is textually different from .mcp.json. Standard Windows path handling can remove the trailing dot when the file is created, so a check against the first string may approve a write that ultimately targets the protected configuration file. Related traversal variants used .. components to begin in an allowed directory and resolve elsewhere.

The important lesson is the order of operations: canonicalize the path with the same semantics the file operation will use, then enforce the allow and deny policy on that canonical result. String prefix tests and raw filename comparisons are not equivalent to containment.

How a settings write became code execution

について researcher demonstrated two configuration-driven execution paths. In the MCP path, the agent could modify MCP configuration and IDE settings so that a malicious command was registered and enabled as an MCP server. When the IDE launched that server, the configuration write crossed into process execution.

In Visual Studio, the researcher also described changing the Copilot ripgrep executable setting. A later search operation could cause the configured binary to run. These are not claims that every file write executes code automatically. They are chains in which a sensitive configuration file controls a later trusted launch.

について researcher identified the shared Copilot component. SSMS matters because it uses Visual Studio technology and included the shared Copilot DLL identified by the researcher. Microsoft’s Visual Studio release notes for 17.14.42 そして 18.10.4 list CVE-2026-103572 with an SSMS SQLtoolsMCPserver.exe RCE description. SSMS 22 release notes show that the October 13 release moved to the serviced Visual Studio 18.11 shell. Organizations should update SSMS through its supported installer and retain the installed version as evidence rather than assuming that updating a separate Visual Studio installation also services SSMS.

Explore Penligent for authorized security testing and remediation verification.

What supplied the attacker-controlled instruction

について researcher’s demonstrated scenario used a malicious instruction in content that the user opened and then interacted with through Copilot. The researcher also notes that adversarial content could arrive through other context sources, including data returned from an MCP server.

This is why the CVSS vector includes user interaction. The user does not necessarily approve the final command as such; the interaction brings untrusted content into an agent that has file tools and trusts configuration-controlled execution. Defensive review should model the complete chain: content source, agent instruction following, file-write authority, configuration sensitivity and process launch.

Affected and fixed Visual Studio versions

The following branch ranges come from the Microsoft CNA record; consult the current Microsoft advisory for servicing updates.

Do not apply this table to unrelated Visual Studio channels without checking Microsoft’s current advisory. Preview and newer servicing branches may have different build numbers. The enterprise decision should come from the installed product inventory and the vendor-supported update channel.

How to inventory Visual Studio and SSMS safely

Use managed software inventory, Visual Studio Installer records or the applications’ About dialogs. Record the product name, channel, full version, install date and whether Copilot or the AI Assistance workload is installed. For SSMS, keep its version separate from standalone Visual Studio.

On Windows endpoints you administer, also inventory MCP configuration and IDE settings locations according to current Microsoft documentation and local policy. The purpose is to identify unexpected server definitions, command paths and recent modifications. Do not execute unknown commands to validate them. Preserve suspicious files and endpoint telemetry for incident response.

Patch verification checklist

1. Identify Visual Studio 2022 17.14, Visual Studio 2026 18.10 and SSMS 22 installations.
2. Update Visual Studio 2022 to 17.14.42 or later and Visual Studio 2026 to 18.10.4 or later through the supported installer.
3. Update SSMS 22 to the current supported release; confirm the update completed for the SSMS installation itself.
4. Restart the IDE and verify the full installed version after servicing.
5. Review enterprise software inventory for endpoints that did not receive the update.
6. Inspect MCP server definitions and Copilot-related executable-path settings for unexpected commands or paths.
7. Correlate suspicious configuration changes with process creation by the IDE or MCP server host.
8. If compromise is suspected, preserve evidence and follow incident-response procedures instead of merely deleting the configuration.

Explore Penligent for authorized security testing and remediation verification.

Interim risk reduction when an update is delayed

Servicing is the durable correction. Until it is complete, reduce the amount of untrusted content given to an agent with file tools, disable or restrict Copilot/MCP features according to enterprise controls where feasible, and review configured MCP servers. Avoid opening untrusted repositories or documents in a privileged developer environment.

These measures reduce opportunity but do not repair the path validation defect. Removing one MCP server also does not address the alternate settings path described by the researcher. Treat compensating controls as temporary and verify the installed fixed version.

Detection questions for defenders

Look for configuration changes followed by IDE-spawned processes, especially commands not present in the organization’s approved MCP catalog. Review recent changes to MCP configuration, Copilot executable settings and SSMS/Visual Studio user settings. Baseline legitimate developer tools first: IDEs routinely start compilers, package managers and language servers.

A trailing-dot filename in a log is a useful investigation clue, not proof of exploitation. Windows normalization and the application’s APIs determine the final target. Correlate the write with the resolved file, user interaction, subsequent configuration load and process creation.

What the public evidence does not establish

について CVE record and its dated enrichment do not establish widespread exploitation. The researcher demonstrated viable RCE chains, while the CVE enrichment initially recorded no known exploitation. That status can change, so incident teams should recheck Microsoft and CISA rather than treating the October snapshot as permanent.

The sources also do not justify labeling every MCP server unsafe. MCP is an execution integration point whose risk depends on configuration, trust and permissions. CVE-2026-103572 was a boundary failure that let an agent alter settings it was supposed to be unable to change.

Engineering lesson: validate the effective path and protect launch configuration

Path authorization must operate on the effective canonical path, handle platform-specific aliases and enforce that the final target remains inside the allowed root. Sensitive filenames need protection after canonicalization, and symbolic links or reparse points require an explicit policy.

Configuration that controls process execution deserves a stronger boundary than ordinary project files. Changes should be visible, attributable and approved where practical. An AI agent’s ability to edit code should not silently imply the ability to replace its search binary or register a new executable server.

Frequently asked questions

Was CVE-2026-103572 a new November 2026 zero-day?

No. Microsoft disclosed and patched it on October 13, 2026. This article is a later technical and remediation analysis.

Does updating Visual Studio update SSMS?

Do not assume so. Inventory and service the SSMS installation through its supported update path, then verify its installed version separately.

Why is MCP relevant?

An MCP server definition can include a command the IDE launches. The demonstrated chain used an unauthorized settings write to register and enable a malicious server, converting configuration control into code execution.

Is disabling Copilot enough?

It can reduce immediate exposure if reliably enforced, but it is not the vendor fix. Update affected products and review configuration for prior unauthorized changes.

Update first, then verify the execution boundary

CVE-2026-103572 shows how an apparently narrow path-validation error can become RCE when the protected files control trusted process launch. Patch the affected Visual Studio and SSMS installations, retain version evidence, and review MCP and executable settings so remediation covers both the vulnerable code and any configuration changed before the update.