CVE-2026-47305: Visual Studio 2022 Auth Bypass Vulnerability

CVE-2026-47305 Overview

CVE-2026-47305 is a protection mechanism failure vulnerability in Microsoft Visual Studio that allows an unauthorized attacker to execute code locally. The flaw is tracked under [CWE-693: Protection Mechanism Failure] and affects Visual Studio 2022 and Visual Studio 2026. Exploitation requires local access and user interaction, but no prior authentication. Successful exploitation results in high impact to confidentiality, integrity, and availability on the affected host.

Critical Impact
An attacker who convinces a developer to open or interact with a malicious project or file can bypass a built-in Visual Studio protection and execute arbitrary code in the user's security context.

Affected Products

Microsoft Visual Studio 2022
Microsoft Visual Studio 2026

Discovery Timeline

2026-07-14 - CVE-2026-47305 published to the National Vulnerability Database
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-47305

Vulnerability Analysis

CVE-2026-47305 is classified under CWE-693, indicating that a security control intended to defend Visual Studio against malicious content does not function as designed. The weakness enables local code execution in the context of the user running the integrated development environment (IDE). Because developer workstations often hold source code, signing keys, cloud credentials, and package publishing tokens, code execution inside Visual Studio provides a high-value foothold for lateral movement.

The vulnerability requires user interaction, which aligns with common Visual Studio attack patterns involving crafted solutions, projects, or dependency files. No network access to the target is required, and the attacker does not need existing credentials on the host.

Root Cause

The root cause is a failure of a protection mechanism inside Visual Studio. A safeguard designed to prevent untrusted content from triggering execution does not adequately isolate or validate the input, allowing the attacker-controlled workflow to reach a code execution path. Microsoft has not published low-level implementation details in the public advisory.

Attack Vector

The attack vector is local and requires the victim to open or interact with attacker-supplied content in Visual Studio. Typical delivery paths for this vulnerability class include malicious repositories cloned from public sources, trojanized project templates, tampered NuGet packages, or crafted solution files delivered via phishing. Once the developer opens the project, the protection failure allows code to run without the expected trust prompt or sandboxing.

Refer to the Microsoft Security Update CVE-2026-47305 advisory for authoritative technical details.

Detection Methods for CVE-2026-47305

Indicators of Compromise

Unexpected child processes spawned by devenv.exe, such as powershell.exe, cmd.exe, rundll32.exe, or mshta.exe.
Newly created scheduled tasks, Run registry keys, or startup entries created shortly after opening a Visual Studio solution.
Outbound network connections from devenv.exe or MSBuild processes to previously unseen domains or IP addresses.
Solution or project files sourced from untrusted repositories that reference unusual pre-build or post-build scripts.

Detection Strategies

Baseline normal Visual Studio process trees and alert on deviations, particularly script interpreters spawned from devenv.exe or MSBuild.exe.
Inspect .sln, .csproj, .vcxproj, and .targets files in newly cloned repositories for suspicious Exec tasks or custom build steps.
Correlate developer workstation identifications with source control activity to detect execution shortly after cloning or opening unfamiliar projects.

Monitoring Recommendations

Enable command-line logging and PowerShell Script Block Logging on developer endpoints to capture post-exploitation activity.
Forward endpoint process, file, and network telemetry to a central data lake for retrospective hunting across Visual Studio hosts.
Track patch compliance for Visual Studio 2022 and Visual Studio 2026 across all developer machines and CI build agents.

How to Mitigate CVE-2026-47305

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-47305 to all Visual Studio 2022 and Visual Studio 2026 installations.
Inventory developer workstations and build servers running Visual Studio and prioritize those with access to production credentials or code signing infrastructure.
Instruct developers to avoid opening untrusted solutions until patching is complete.

Patch Information

Microsoft has published fixed builds through the Microsoft Update Guide. Administrators should deploy the updates using Microsoft Update, Windows Server Update Services (WSUS), Microsoft Intune, or the in-product Visual Studio Installer. Verify the installed version reflects the patched build number listed in the MSRC advisory after deployment.

Workarounds

Restrict opening of Visual Studio solutions from untrusted sources, including email attachments and unfamiliar Git repositories.
Use the Visual Studio Trust Settings feature to require confirmation before opening projects from unknown locations.
Run Visual Studio under a standard user account rather than a local administrator to limit the impact of local code execution.

bash

# Configuration example: verify installed Visual Studio version against the patched build
"%ProgramFiles(x86)%\Microsoft Visual Studio\Installer\vswhere.exe" -all -property installationVersion