# CVE-2026-103572: Microsoft October Patch Tuesday: A Trailing Dot Let Copilot in Visual Studio and SSMS Rewrite Its Own MCP Config (CVE-2026-103572, CVSS 8.8), Plus Two VS Code Copilot and MCP Sandbox Bypasses

> CVE-2026-103572 is a high-severity remote code execution issue (CVSS 8.8) in Visual Studio, a MCP server. Affected: Visual Studio 2022 17.14 before 17.14.42 and Visual Studio 2026 18.10 before 18.10.4, plus SQL Server Management Studio (CVE-2026-103572; check Microsoft's update guide for the SSMS build); VS Code 1.141.0 and earlier (CVE-2026-102232, CVE-2026-102851).. Fixed in 17.14.42.

- **Canonical URL:** https://catalog.anomity.ai/vuln/cve-2026-103572
- **Aliases:** ti-135, GHSA-fq62-m6f5-c7h9
- **Severity:** high
- **CVSS:** 8.8
- **Attack type:** Remote code execution, Prompt injection
- **Component:** Visual Studio (MCP server)
- **Catalog entry:** https://catalog.anomity.ai/agent/visual-studio
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-10-13
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/cve-2026-103572

## Summary

Microsoft shipped fixes on 13 October 2026 for three agent-related flaws. CVE-2026-103572 (CVSS 3.1 8.8, Important, Remote Code Execution) sits in the Copilot component that Visual Studio and SQL Server Management Studio share (Microsoft.VisualStudio.Copilot.Core.dll). Embrace The Red, which reported it on 4 August, showed that the check meant to stop Copilot editing its own protected files compared the literal path: a write to `.mcp.json.` or `settings.VisualStudio.json.` passed the check, then Windows dropped the trailing dot and wrote the real file. A prompt-injected agent could add a command as an MCP server and enable it, or, in Visual Studio only, point the Copilot ripgrepPath setting at any binary so it runs on the next search. The report also covered `..\` traversal out of the trusted Extensions directory. The fix normalizes paths with GetFullPath, and Microsoft paid no bounty. In VS Code, CVE-2026-102232 (CVSS 7.0, GHSA-fq62-m6f5-c7h9) let the local Copilot harness auto-approve edits to custom hook and agent-definition locations set in chat.hookFilesLocations or chat.agentFilesLocations, so a prompt injection could plant a shell command that ran the next time the hook fired. CVE-2026-102851 (CVSS 6.1, GHSA-qghm-w43w-vx8v) saved MCP sandbox network and filesystem-write approvals in shared configuration, so one MCP server could use permissions approved for another. Both are fixed in VS Code 1.141.1. Microsoft lists none of the three as exploited or publicly disclosed before release.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| Visual Studio 2022 17.14 before 17.14.42 and Visual Studio 2026 18.10 before 18.10.4, plus SQL Server Management Studio (CVE-2026-103572; check Microsoft's update guide for the SSMS build); VS Code 1.141.0 and earlier (CVE-2026-102232, CVE-2026-102851). | 17.14.42 |

## Am I affected by CVE-2026-103572?

You are affected if you run Visual Studio 2022 17.14 before 17.14.42 and Visual Studio 2026 18.10 before 18.10.4, plus SQL Server Management Studio (CVE-2026-103572; check Microsoft's update guide for the SSMS build); VS Code 1.141.0 and earlier (CVE-2026-102232, CVE-2026-102851).. Versions 17.14.42 and later include the fix.

## How do I fix CVE-2026-103572?

Update Visual Studio 2022 to 17.14.42 or later, Visual Studio 2026 to 18.10.4 or later, SSMS to its October build, and VS Code to 1.141.1 or later. Review .mcp.json, settings.VisualStudio.json and the SSMS settings.json for MCP servers, enabledMcpServers entries or ripgrepPath values nobody added. Until VS Code is updated, set chat.useHooks and chat.useClaudeHooks to false, or remove custom chat.hookFilesLocations and chat.agentFilesLocations entries, and run only trusted MCP servers without approving extra sandbox access in shared configurations. Alert when an agent edits its own configuration, MCP or hook files.

## How do I find every machine running Visual Studio?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Visual Studio and which version, then enforce a policy on it.

## References

- article: https://embracethered.com/blog/posts/2026/visual-studio-copilot-remote-code-execution/
- cve: https://nvd.nist.gov/vuln/detail/CVE-2026-103572
- advisory: https://github.com/advisories/GHSA-fq62-m6f5-c7h9

## Related vulnerabilities

- [CVE-2026-10591](https://catalog.anomity.ai/vuln/cve-2026-10591) — critical
- [CVE-2026-114090](https://catalog.anomity.ai/vuln/cve-2026-114090) — high
- [CVE-2026-114612](https://catalog.anomity.ai/vuln/cve-2026-114612) — critical
- [forever-security-an-agents-md-planted-in-downloads-got-codex-to](https://catalog.anomity.ai/vuln/forever-security-an-agents-md-planted-in-downloads-got-codex-to) — high
- [CVE-2025-49596](https://catalog.anomity.ai/vuln/cve-2025-49596) — critical
- [CVE-2026-32871](https://catalog.anomity.ai/vuln/cve-2026-32871) — critical

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=cve-2026-103572