CERT-FR Advisory: Microsoft Visual Studio Vulnerability Allows Security Feature Bypass
CERT-FR issued advisory CERTFR-2026-AVI-1441 on a vulnerability affecting Microsoft Visual Studio that allows an attacker to bypass a security policy mechanism. The flaw, tracked as CVE-2026-118147, impacts Visual Studio 2017 (15.9, prior to 15.9.84), 2019 (16.11, prior to 16.11.62), 2022 (17.14, prior to 17.14.44), and 2026 (18.11, prior to 18.11.3). The advisory references Microsoft's security bulletin published 30 October 2026 and directs users to apply the vendor's patches.
Entenda a falha
A vulnerabilidade
CVE-2026-118147 is a security policy bypass (security feature bypass) in Microsoft Visual Studio. CERT-FR says an attacker can bypass a security policy mechanism, but the articles give no details on the component, the attack requirements (network reach, authentication, user interaction) or the impact. Affected versions: 2017 15.9 before 15.9.84, 2019 16.11 before 16.11.62, 2022 17.14 before 17.14.44 and 2026 18.11 before 18.11.3. The fix is in those versions and later, via Microsoft's patches.
Como foi descoberta
The articles do not say who found the flaw or how. They only report that Microsoft published a security bulletin for CVE-2026-118147 on 30 October 2026, and that CERT-FR issued advisory CERTFR-2026-AVI-1441 on 2 November 2026 pointing users to the vendor's bulletin for the patches.
Explicação gerada por IA a partir da matéria e dos artigos, em 04/11/2026 14:23.
Detalhes técnicos
- CVE-2026-118147: security policy bypass in Microsoft Visual Studio.
- Affected versions: 2017 15.9 (<15.9.84), 2019 16.11 (<16.11.62), 2022 17.14 (<17.14.44), 2026 18.11 (<18.11.3).
Remediação
- Apply the patches referenced in Microsoft's security bulletin for CVE-2026-118147.
Linha do tempo
-
CERT-FR Advisory: Microsoft Visual Studio Vulnerability Allows Security Feature Bypass
ler a análise desta fonte ocultar
CERT-FR issued advisory CERTFR-2026-AVI-1441 on a vulnerability affecting Microsoft Visual Studio that allows an attacker to bypass a security policy mechanism. The flaw, tracked as CVE-2026-118147, impacts Visual Studio 2017 (15.9, prior to 15.9.84), 2019 (16.11, prior to 16.11.62), 2022 (17.14, prior to 17.14.44), and 2026 (18.11, prior to 18.11.3). The advisory references Microsoft's security bulletin published 30 October 2026 and directs users to apply the vendor's patches.
Technical Details
- CVE-2026-118147: security policy bypass in Microsoft Visual Studio.
- Affected versions: 2017 15.9 (<15.9.84), 2019 16.11 (<16.11.62), 2022 17.14 (<17.14.44), 2026 18.11 (<18.11.3).
Remediation
- Apply the patches referenced in Microsoft's security bulletin for CVE-2026-118147.