Is CVE-2026-47305 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47305 being exploited in the wild.

How severe is CVE-2026-47305?

High severity, with a CVSS score of 7.8, published 14 July 2026.

Which products and versions are affected?

Microsoft Visual Studio 2022 17.12.0 to 17.12.22.

Is there a fix for CVE-2026-47305?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-47305 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-47305?

Check whether you run Microsoft Visual Studio 2022 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47305: Microsoft Visual Studio protection mechanism failure local code execution

CVE-2026-47305 · Severity: high · CVSS 7.8 · Published 2026-07-14

Microsoft Visual Studio, a widely used software development environment, contains a security flaw that could allow an attacker to execute malicious code on a developer's computer. To exploit this, an attacker would typically need to trick a user into opening a specially crafted file or project. If successful, the attacker could gain the same permissions as the local user, potentially leading to data theft or full system compromise.

Technologies: Microsoft Visual Studio 2022. Vendors: Microsoft.

Quick answers

Is CVE-2026-47305 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47305 being exploited in the wild.
How severe is CVE-2026-47305?: High severity, with a CVSS score of 7.8, published 14 July 2026.
Which products and versions are affected?: Microsoft Visual Studio 2022 17.12.0 to 17.12.22.
Is there a fix for CVE-2026-47305?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-47305 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-47305?: Check whether you run Microsoft Visual Studio 2022 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A protection mechanism failure (CWE-693) exists in multiple versions of Microsoft Visual Studio, including 2022 and 2026. The vulnerability is triggered when the application fails to properly enforce security boundaries, allowing for local code execution. While the attack vector is local, it requires user interaction (UI:R), suggesting the exploit involves a victim opening a malicious file or project. Successful exploitation grants the attacker high-impact capabilities across confidentiality, integrity, and availability. Microsoft has released security updates to address this issue in the affected versions.

Affected products

Microsoft Visual Studio 2022 version 17.12 17.12.0 to 17.12.22
Microsoft Visual Studio 2022 version 17.14 17.14.0 to 17.14.36
Microsoft Visual Studio 2026 version 18.7 18.0 to 18.7.4

Timeline

2026-07-14: advisory: Initial publication of CVE-2026-47305 by Microsoft and NVD.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47305

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.