Microsoft published CVE-2026-118147 on October 30, 2026, as an Important Visual Studio security advisory.[1] The issue is improper certificate validation that can allow spoofing over a network.[1]
Reporting cutoff: October 30, 2026, 7:25 pm EDT (23:25 UTC). This is not Patch Tuesday or a Windows operating-system KB, Windows preview, or Insider build.[1][8] It is not an Apple update.[7] The fixed Visual Studio builds were released October 29; Microsoft’s advisory was published at 2026-10-30T07:00:00Z.[1][2][3][4][5]
Bottom line: If one of the four specifically named affected branches is installed, compare its branch and build with the fixed-build matrix and update that branch to at least the listed fixed build. Microsoft rates exploitation less likely and reported neither public disclosure nor exploitation at the cutoff, but customer action is required.[1]
Threat condition: Microsoft says an attacker must place themselves in the logical network path between the target and the requested resource—a machine-in-the-middle condition—to read or modify communications.[1]
Affected and fixed builds
| Visual Studio line | Fixed build | Release date | Check |
|---|---|---|---|
| Visual Studio 2026 | 18.11.3[1][2] | October 29, 2026[2] | For the specifically named affected branch Visual Studio 2026 version 18.11, Microsoft lists 18.11.3 as the fixed build.[1] |
| Visual Studio 2022 | 17.14.44[1][3] | October 29, 2026[3] | For the specifically named affected branch Visual Studio 2022 version 17.14, Microsoft lists 17.14.44 as the fixed build.[1] |
| Visual Studio 2019 | 16.11.62[1][4] | October 29, 2026[4] | For the specifically named affected branch Visual Studio 2019 version 16.11, Microsoft lists 16.11.62 as the fixed build.[1] |
| Visual Studio 2017 | 15.9.84[1][5] | October 29, 2026[5] | For the specifically named affected branch Visual Studio 2017 version 15.9, Microsoft lists 15.9.84 as the fixed build.[1] |
How to tell whether you are affected
- Check whether Visual Studio is installed. This advisory is about the Visual Studio IDE, not Windows itself.[1]
- Open Visual Studio and check the installed version. Compare the major product line and build with the matrix above.[6]
- Not affected by this advisory: A device without Visual Studio is outside this advisory. Among the four named branches, installations at or above the listed fixed build are fixed for this CVE; this is not a universal claim about Visual Studio. This is a product-and-version applicability check, not a statement that the device has no other security issues.[1]
- Needs action: a specifically named affected branch below its listed fixed build needs action. Use the Visual Studio Installer or the IDE’s update check to obtain the current release from your configured source.[1][6]
What home users should do
- If you do not use Visual Studio, do not hunt for a Windows KB. This advisory does not say Windows itself was patched today.[1]
- If one of the four named affected branches is installed below the fixed build, save work, close the IDE, and update it. Microsoft’s update guidance says to close Visual Studio and save work before updating, and the advisory marks customer action required.[1][6]
- After updating, reopen the IDE and confirm the build. If the installer requests a restart, follow that prompt.[6]
What businesses and IT teams should do
- Inventory all four Visual Studio generations. Include developer workstations, build machines, shared labs, and offline or network-layout installations.[1][6]
- Map each installation to the fixed build before deployment. The minimums are 18.11.3, 17.14.44, 16.11.62, and 15.9.84.[1]
- Pilot through the organization’s configured update source. Microsoft documents internet and internal update sources and notes that enterprise administrators may control updates.[6]
- Verify the resulting build, record exceptions, and follow any installer restart prompt.[6]
- Treat unusual certificate or network-path behavior as a defensive investigation lead. The vendor’s prerequisite is a machine-in-the-middle position; this article does not provide offensive interception steps.[1]
Good and bad
Good
Bad
- Successful exploitation can expose highly sensitive information and cause a total loss of protection for that data, according to Microsoft’s advisory.[1]
- Organizations may have several Visual Studio generations and controlled update channels to inventory.[1][6]
- The network-path prerequisite reduces likelihood; it does not make an affected build fixed.[1]
Windows and Apple checks at the cutoff
The Windows Message Center had no October 30 announcement in the captured recent-announcements table. Its newest relevant entry was Cuba daylight-saving-time guidance dated October 29 PT; the October 28 Windows 11 item was explicitly a non-security preview.[8]
Apple’s security page showed a Published Date of October 30, but that is page metadata, not a same-day release row. The newest security-table row was Xcode 27.2 on October 29; the listed macOS rows were dated October 26.[7] This bounded negative check is why this article remains a Visual Studio advisory rather than a Windows/macOS roundup.
FAQ
Was Windows patched for CVE-2026-118147 today?
No. Microsoft identifies Visual Studio as the affected product and publishes Visual Studio fixed builds.[1]
Is this Patch Tuesday?
No. This is a Visual Studio security advisory published October 30, with fixed builds released October 29.[1][2][3][4][5]
Is exploitation active?
Microsoft reported Exploited: No, Publicly Disclosed: No, and Exploitation Less Likely at the reporting cutoff.[1]
Does the attacker need local access?
Microsoft describes a network-path prerequisite: the attacker must inject themselves between the target and the requested resource in a machine-in-the-middle attack.[1]
What if Visual Studio is managed by my employer?
Use the organization’s approved update source and change process; Microsoft notes that enterprise administrators may control how Visual Studio updates a machine.[6]
Official sources
- Microsoft Security Response Center: CVE-2026-118147
- Microsoft: Visual Studio 2026 release notes
- Microsoft: Visual Studio 2022 release notes
- Microsoft: Visual Studio 2019 release notes
- Microsoft: Visual Studio 2017 release notes
- Microsoft: Update Visual Studio
- Apple security releases
- Microsoft: Windows Message Center