CVE-2026-96237: 
Visual Studio 2022 vulnerability analysis and mitigation

CVE-2026-96237 is a remote code execution vulnerability in Microsoft .NET caused by the inclusion of functionality from an untrusted control sphere (CWE-829). It affects .NET 8.0 (before 8.0.132), .NET 9.0 (before 9.0.319), .NET 10.0 (before 10.0.113), Microsoft Visual Studio 2022 version 17.14 (before 17.14.42), and Microsoft Visual Studio 2026 version 18.10 (before 18.10.4). The vulnerability was disclosed on October 13, 2026, as part of Microsoft's October 2026 Patch Tuesday. It carries a CVSS v3.1 base score of 7.5 (High) (Microsoft MSRC).

The vulnerability is classified under CWE-829 (Inclusion of Functionality from Untrusted Control Sphere), meaning the .NET runtime improperly incorporates code or resources from an untrusted source during execution. An unauthenticated remote attacker can exploit this over a network, but exploitation requires user interaction and involves high attack complexity, limiting opportunistic mass exploitation. The attack vector is network-based with no privileges required, but a user must be induced to perform some action (e.g., open a malicious file or visit a crafted resource) that triggers the untrusted code inclusion (Microsoft MSRC, Feedly). No public technical write-ups or proof-of-concept code have been identified at this time.

Successful exploitation allows an unauthenticated attacker to execute arbitrary code on the target system, resulting in high impact to confidentiality, integrity, and availability. This could enable an attacker to access sensitive data, modify system files or application logic, and disrupt service availability on affected .NET or Visual Studio environments. The scope is unchanged, meaning the impact is contained to the vulnerable component, but arbitrary code execution could serve as a foothold for further lateral movement within an environment (Microsoft MSRC).

As of the disclosure date (October 13, 2026), there is no evidence of active in-the-wild exploitation and no public proof-of-concept exploit code has been identified. The EPSS score is 0.0, reflecting a currently low probability of exploitation in the near term. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. The requirement for user interaction and high attack complexity further reduces the likelihood of automated or widespread exploitation (Microsoft MSRC).

Microsoft has released patches addressing this vulnerability as part of the October 2026 Patch Tuesday update cycle. Organizations should update to the following fixed versions immediately:

• .NET 8.0: Update to 8.0.132 or later
• .NET 9.0: Update to 9.0.319 or later
• .NET 10.0: Update to 10.0.113 or later
• Visual Studio 2022 (v17.14): Update to 17.14.42 or later
• Visual Studio 2026 (v18.10): Update to 18.10.4 or later

No configuration-based workarounds have been published; patching is the recommended remediation. Given the network-accessible nature and potential for remote code execution, these updates should be applied with high priority (Microsoft MSRC).

The vulnerability was noted in the Zero Day Initiative's October 2026 Security Update Review and covered by BleepingComputer as part of broader Patch Tuesday reporting, which addressed 1,411 flaws and 3 zero-days in that cycle (ZDI Blog, BleepingComputer). No significant standalone researcher commentary or social media discussion specific to CVE-2026-96237 has been identified beyond standard Patch Tuesday coverage.