Visual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)

AI security research · Embrace The Red (Johann Rehberger)

Visual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)

REDCORE assessment

This research demonstrates how an LLM-integrated tool can be manipulated via path traversal to overwrite its own security-critical configuration files. By tricking the agent into bypassing input validation, the attacker gains the ability to execute arbitrary commands. While the exploit requires specific tool interactions, the research serves as a critical reminder that agentic tools with write access to internal configuration are high-value targets for privilege escalation.

Impact for lean teams

A successful exploitation could allow an attacker to execute arbitrary code on your development machines. Small teams should prioritize updating their IDE and extension environments to the latest patched versions immediately.

Source summary

<p><strong>A <code>.</code> is all you need!</strong></p> <p>Today Microsoft <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-103572">shipped the patch</a> for a vulnerability in Visual Studio Copilot that I reported in August. Microsoft classified it as <code>Important</code> severity <code>Remote Code Execution</code> vulnerability.</p> <p><a href="https://embracethered.com/blog/images/2026/sqlcopilot/copilot-vs-rce.png"><img src="https://embracethered.com/blog/images/2026/sqlcopilot/copilot-vs-rce.png" alt="Visual Studio Remote Code Execution"></a></p> <p>At the root cause it allows Copilot in Visual Studio or SQL Server Management Studio to <strong>bypass a path validation check and write to its own settings and configuration files</strong>. This allows Copilot to escape containment restrictions and achieve arbitrary command execution.</p>

Recommended actions

• Apply the patch provided by Microsoft via the Visual Studio and SQL Server Management Studio update channels.
• Restrict developer environment administrative privileges to minimize the impact of successful code execution.
• Implement endpoint detection and response (EDR) solutions to monitor for suspicious file modifications in IDE configuration directories.
• Enforce the principle of least privilege for automated development tools that have filesystem access.

This assessment was generated by REDCORE AI from the attributed source above and is provided for situational awareness. Validate against the original research and your own environment before acting.