Security Advisory: Remote Code Execution in Microsoft Visual Studio (CVE-2026-47305)
Document ID: [Insert Internal Advisory ID, e.g., ADV-2026-001]
Publication Date: Jul 14, 2026
CVE Identifier: CVE-2026-47305
Severity: High
CVSSv3.1 Score: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Reported By: Arun T – Consultant – Red Team
1. Executive Summary
Our security research team has discovered a High-severity Remote Code Execution (RCE) vulnerability in Microsoft Visual Studio. Tracked as CVE-2026-47305, the vulnerability stems from a protection mechanism failure (CWE-693) that permits a Mark-of-the-Web (MOTW) bypass. This allows an unauthorized attacker to execute arbitrary code locally on a targeted machine.
Microsoft has acknowledged this vulnerability and released patches as part of their July 2026 Patch Tuesday update.
2. Technical Details
The vulnerability specifically exists within how Visual Studio handles project files. By exploiting a Mark-of-the-Web (MOTW) bypass, a threat actor can craft a malicious .vcxproj file utilizing the InitialTargets property.
When a victim is tricked into opening this crafted project file in an affected version of Visual Studio, the protection mechanisms fail to safely restrict execution. Because user interaction is required (the user must open the malicious file), the attack vector is categorized as Local (AV:L), but it effectively functions as a remote code execution vector via social engineering.
Weakness Enumeration: CWE-693: Protection Mechanism Failure
3. Impact
Successful exploitation of this vulnerability allows an attacker to execute arbitrary code with the privileges of the user running Visual Studio. This could lead to full system compromise, data theft, lateral movement within the network, or the installation of malware/ransomware.
4. Affected Software
The following versions of Microsoft Visual Studio are known to be vulnerable:
- Microsoft Visual Studio 2026 (version 18.7): Versions 18.0 to 18.7.3 (Fixed in 18.7.4)
- Microsoft Visual Studio 2022 (version 17.14): Versions 17.14.0 to 17.14.35 (Fixed in 17.14.36)
- Microsoft Visual Studio 2022 (version 17.12): Versions 17.12.0 to 17.12.21 (Fixed in 17.12.22)
5. Remediation
Microsoft has addressed this issue in their latest security releases. We strongly recommend all users and organizations using Visual Studio update their IDEs immediately to the patched versions:
- VS 2026: Update to version 18.7.4 or later.
- VS 2022 (17.14): Update to version 17.14.36 or later.
- VS 2022 (17.12): Update to version 17.12.22 or later.
Updates can be applied directly through the Visual Studio Installer or by downloading the latest version from the official Microsoft portal.