Microsoft Patch Tuesday Fixes High-Risk RCE in Visual Studio Copilot

Security researcher wunderwuzzi disclosed a high-risk RCE in Visual Studio Copilot, where the safeguard code relied only on filename matching to block writes to mcp/settings config files. Microsoft shipped an emergency fix in its October Patch Tuesday.

2026-10-14 ~ 2026-10-14 · 2 related posts

• Filename-only guard in VS Copilot led to high-severity RCE, patched this Patch Tuesday — wunderwuzzi23 · 2026-10-14
• VS Copilot flaw led to high-severity RCE in Visual Studio and SSMS, now patched as CVE-2026-103572 — wunderwuzzi23 · 2026-10-14