CERT-FR: Privilege escalation vulnerability CVE-2026-111497 in Microsoft Visual Studio and PowerShell (CERTFR-2026-AVI-1383)
CERT-FR published advisory CERTFR-2026-AVI-1383 on a vulnerability in Microsoft products, tracked as CVE-2026-111497. It allows an attacker to perform privilege escalation. The advisory is based on the Microsoft security bulletin of 25 October 2026 and affects several Visual Studio branches and PowerShell 7.x releases. The advisory reports no active exploitation, CVSS score or IOCs.
Entenda a falha
A vulnerabilidade
CVE-2026-111497 is a privilege escalation flaw in Microsoft Visual Studio and PowerShell 7. The sources give no component, attack vector, authentication requirement or CVSS score. An attacker who exploits it gets higher privileges than they started with. Affected: Visual Studio 2019 16.11 before 16.11.61, 2022 17.14 before 17.14.43, 2026 18.11 before 18.11.2 and 18.12 before 18.12 Insiders 3, and PowerShell 7.4 before 7.4.22, 7.5 before 7.5.13 and 7.6 before 7.6.9. Those versions are the fixed releases.
Como funciona
The sources do not describe how the vulnerable process works. The CERT-FR advisory only says the flaw lets an attacker escalate privileges, and it names no input, component or step where the software fails. Details may be in the Microsoft bulletin, which the advisory points to but does not reproduce.
Por que é vulnerável
The root cause has not been published in the sources. The advisory gives no weakness class and does not say what the fix changes or why the flaw went unnoticed.
Como foi descoberta
CERT-FR published advisory CERTFR-2026-AVI-1383 on 26 October 2026, based on the Microsoft security bulletin for CVE-2026-111497 dated 25 October 2026. The sources do not say who found the flaw or how it was reported. The advisory reports no active exploitation.
Explicação gerada por IA a partir da matéria e dos artigos, em 28/10/2026 14:22.
Detalhes técnicos
- Affected: Visual Studio 2019 16.11 before 16.11.61; Visual Studio 2022 17.14 before 17.14.43; Visual Studio 2026 18.11 before 18.11.2 and 18.12 before 18.12 Insiders 3.
- Affected: PowerShell 7.4 before 7.4.22, 7.5 before 7.5.13 and 7.6 before 7.6.9.
- Impact: privilege escalation. The advisory gives no root cause or attack vector.
Remediação
- Apply the fixes described in the Microsoft security bulletin for CVE-2026-111497, as CERT-FR directs.
- Update to the fixed versions listed above.
Linha do tempo
-
CERT-FR: Privilege escalation vulnerability CVE-2026-111497 in Microsoft Visual Studio and PowerShell (CERTFR-2026-AVI-1383)
ler a análise desta fonte ocultar
CERT-FR published advisory CERTFR-2026-AVI-1383 on a vulnerability in Microsoft products, tracked as CVE-2026-111497. It allows an attacker to perform privilege escalation. The advisory is based on the Microsoft security bulletin of 25 October 2026 and affects several Visual Studio branches and PowerShell 7.x releases. The advisory reports no active exploitation, CVSS score or IOCs.
Technical Details
- Affected: Visual Studio 2019 16.11 before 16.11.61; Visual Studio 2022 17.14 before 17.14.43; Visual Studio 2026 18.11 before 18.11.2 and 18.12 before 18.12 Insiders 3.
- Affected: PowerShell 7.4 before 7.4.22, 7.5 before 7.5.13 and 7.6 before 7.6.9.
- Impact: privilege escalation. The advisory gives no root cause or attack vector.
Remediation
- Apply the fixes described in the Microsoft security bulletin for CVE-2026-111497, as CERT-FR directs.
- Update to the fixed versions listed above.