Visual Studio 2022 vulnerabilities

10 known vulnerabilities in Visual Studio 2022 from Microsoft. 10 are rated high or critical, and 2 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.4 Critical severity

  ASP.NET Core 10.0: Inconsistent Interpretation of HTTP Requests

  CVE-2026-88092Oct 13, 2026MicrosoftEPSS 1.04%

  Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.

• 8.0 High severity

  Microsoft Visual Studio 2022 version 17.14: Improper Neutralization of Special Elements used in a Command

  CVE-2026-21257Feb 10, 2026Microsoft

  Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an authorized attacker to elevate privileges over a network.

• 8.8 High severity

  Microsoft Visual Studio 2022 version 17.14: Improper Neutralization of Special Elements used in a Command

  CVE-2026-21256Feb 10, 2026MicrosoftEPSS 1.16%

  Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code over a network.

• 9.9 Critical severity

  ASP.NET Core 2.3: Inconsistent Interpretation of HTTP Requests

  CVE-2025-55315Oct 14, 2025MicrosoftEPSS 67.2%

  Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.

• 7.8 High severity

  Microsoft Visual Studio 2022 version 17.14: Improper Neutralization of Special Elements used in a Command

  CVE-2025-53773Aug 12, 2025MicrosoftEPSS 3.51%

  Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code locally.

• 7.1 High severity

  Microsoft Visual Studio 2022 version 17.10: Improper Neutralization of Special Elements used in a Command

  CVE-2025-47959Jun 13, 2025MicrosoftEPSS 11.4%

  Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an authorized attacker to execute code over a network.

• 8.0 High severity

  .NET 8.0: External Control of File Name or Path

  CVE-2025-26646May 13, 2025MicrosoftEPSS 1.29%

  External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network.

• 7.8 High severity

  Microsoft Visual Studio 2019 version 16.11…: Improper Neutralization of Special Elements used in a Command

  CVE-2025-32702May 13, 2025Microsoft

  Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an unauthorized attacker to execute code locally.

• 7.5 High severity

  HTTP/2 Rapid Reset Attack Exploited

  CVE-2023-44487Oct 10, 2023IETFEPSS 100%

  The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

• 7.5 High severity

  Microsoft .NET Core and Visual Studio Denial-of-Service Exploited

  CVE-2023-38180Aug 8, 2023MicrosoftEPSS 14.1%

  .NET and Visual Studio Denial of Service Vulnerability