Microsoft Visual Studio 2017 vulnerabilities

93 CVEs affecting Microsoft Visual Studio 2017, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-47304, published 2026-07-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-1147: Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability, published 2020-07-14. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 94% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework,…
CVE-2021-36952, published 2021-09-15. High severity, CVSS 7.8. EPSS: 51.5% chance of exploitation in the next 30 days. Visual Studio Remote Code Execution Vulnerability
CVE-2019-1349, published 2020-01-24. High severity, CVSS 8.8. EPSS: 34% chance of exploitation in the next 30 days. A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from…
CVE-2018-8172, published 2018-07-11. High severity, CVSS 7.8. EPSS: 33.6% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in Visual Studio software when the software does not check the source markup of a file for an unbuilt project, aka "Visual Studio Remote Code Execution…
CVE-2019-1350, published 2020-01-24. High severity, CVSS 8.8. EPSS: 25.7% chance of exploitation in the next 30 days. A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from…
CVE-2019-1352, published 2020-01-24. High severity, CVSS 8.8. EPSS: 24% chance of exploitation in the next 30 days. A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from…
CVE-2019-1354, published 2020-01-24. High severity, CVSS 8.8. EPSS: 22.6% chance of exploitation in the next 30 days. A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from…
CVE-2019-0546, published 2019-01-08. High severity, CVSS 7.8. EPSS: 16.2% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in Visual Studio when the C++ compiler improperly handles specific combinations of C++ constructs, aka "Visual Studio Remote Code Execution…
CVE-2019-0613, published 2019-03-05. High severity, CVSS 8.8. EPSS: 15.4% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in .NET Framework and Visual Studio software when the software fails to check the source markup of a file.An attacker who successfully exploited the…
CVE-2019-0809, published 2019-04-09. High severity, CVSS 7.8. EPSS: 10.6% chance of exploitation in the next 30 days. A remote code execution vulnerability exists when the Visual Studio C++ Redistributable Installer improperly validates input before loading dynamic link library (DLL) files, aka 'Visual Studio Remote…

Latest

CVE-2026-47304, published 2026-07-14. Critical severity, CVSS 9.8. EPSS: 0.3% chance of exploitation in the next 30 days. Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
CVE-2025-55240, published 2025-10-14. High severity, CVSS 7.3. EPSS: 0.4% chance of exploitation in the next 30 days. Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally.
CVE-2025-49739, published 2025-07-08. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. Improper link resolution before file access ('link following') in Visual Studio allows an unauthorized attacker to elevate privileges over a network.
CVE-2025-32703, published 2025-05-13. Medium severity, CVSS 5.5. EPSS: 0.5% chance of exploitation in the next 30 days. Insufficient granularity of access control in Visual Studio allows an authorized attacker to disclose information locally.
CVE-2025-24998, published 2025-03-11. High severity, CVSS 7.3. EPSS: 0.5% chance of exploitation in the next 30 days. Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally.
CVE-2025-21206, published 2025-02-11. High severity, CVSS 7.3. EPSS: 0.7% chance of exploitation in the next 30 days. Visual Studio Installer Elevation of Privilege Vulnerability
CVE-2025-21178, published 2025-01-14. High severity, CVSS 8.8. EPSS: 1.6% chance of exploitation in the next 30 days. Visual Studio Remote Code Execution Vulnerability
CVE-2025-21176, published 2025-01-14. High severity, CVSS 8.8. EPSS: 2.3% chance of exploitation in the next 30 days. .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
CVE-2025-21172, published 2025-01-14. High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days. .NET and Visual Studio Remote Code Execution Vulnerability
CVE-2024-43603, published 2024-10-08. Medium severity, CVSS 5.5. EPSS: 0.8% chance of exploitation in the next 30 days. Visual Studio Collector Service Denial of Service Vulnerability