VulnerabilitiesMicrosoft patches code execution flaw in Visual Studio Copilot
A path validation bypass let the Copilot coding agent write to its own settings files and run arbitrary commands, according to the researcher who reported it.
14 Oct 2026
Visual Studio Copilot RCE Vulnerability Patched (CVE-2026-103572)
A path validation bypass in Visual Studio Copilot and SQL Server Management Studio allowed the Copilot agent to write to its own settings/configuration files, escaping containment and achieving arbitrary code execution. Microsoft patched the Important-severity RCE after it was reported in August 2026.
Record updated 14 October 2026
Impact
Flaw let the Copilot coding agent bypass a path validation check to write to its own config files, enabling arbitrary command execution on affected systems.
Our coverage
VulnerabilitiesSources
- embracethered.comhttps://embracethered.com/blog/posts/2026/visual-studio-copilot-remote-code-execution