Microsoft Visual Studio 2019 vulnerabilities

119 CVEs affecting Microsoft Visual Studio 2019, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-47304, published 2026-07-14.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-1147: Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability, published 2020-07-14. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 94% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework,…
• CVE-2021-27068, published 2021-05-11. High severity, CVSS 8.8. EPSS: 53.6% chance of exploitation in the next 30 days. Visual Studio Remote Code Execution Vulnerability
• CVE-2021-36952, published 2021-09-15. High severity, CVSS 7.8. EPSS: 51.5% chance of exploitation in the next 30 days. Visual Studio Remote Code Execution Vulnerability
• CVE-2019-1349, published 2020-01-24. High severity, CVSS 8.8. EPSS: 34% chance of exploitation in the next 30 days. A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from…
• CVE-2021-26701, published 2021-02-25. High severity, CVSS 8.1. EPSS: 30.1% chance of exploitation in the next 30 days. .NET Core Remote Code Execution Vulnerability
• CVE-2019-1350, published 2020-01-24. High severity, CVSS 8.8. EPSS: 25.7% chance of exploitation in the next 30 days. A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from…
• CVE-2019-1352, published 2020-01-24. High severity, CVSS 8.8. EPSS: 24% chance of exploitation in the next 30 days. A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from…
• CVE-2019-1354, published 2020-01-24. High severity, CVSS 8.8. EPSS: 22.6% chance of exploitation in the next 30 days. A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from…
• CVE-2021-41355, published 2021-10-13. Medium severity, CVSS 5.7. EPSS: 20.3% chance of exploitation in the next 30 days. .NET Core and Visual Studio Information Disclosure Vulnerability
• CVE-2019-1351, published 2020-01-24. High severity, CVSS 7.5. EPSS: 8.7% chance of exploitation in the next 30 days. A tampering vulnerability exists when Git for Visual Studio improperly handles virtual drive paths, aka 'Git for Visual Studio Tampering Vulnerability'.

Latest

• CVE-2026-47304, published 2026-07-14. Critical severity, CVSS 9.8. EPSS: 0.3% chance of exploitation in the next 30 days. Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
• CVE-2025-55240, published 2025-10-14. High severity, CVSS 7.3. EPSS: 0.4% chance of exploitation in the next 30 days. Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally.
• CVE-2025-49739, published 2025-07-08. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. Improper link resolution before file access ('link following') in Visual Studio allows an unauthorized attacker to elevate privileges over a network.
• CVE-2025-32703, published 2025-05-13. Medium severity, CVSS 5.5. EPSS: 0.5% chance of exploitation in the next 30 days. Insufficient granularity of access control in Visual Studio allows an authorized attacker to disclose information locally.
• CVE-2025-32702, published 2025-05-13. High severity, CVSS 7.8. EPSS: 0.6% chance of exploitation in the next 30 days. Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an unauthorized attacker to execute code locally.
• CVE-2025-25003, published 2025-03-11. High severity, CVSS 7.3. EPSS: 0.5% chance of exploitation in the next 30 days. Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally.
• CVE-2025-24998, published 2025-03-11. High severity, CVSS 7.3. EPSS: 0.5% chance of exploitation in the next 30 days. Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally.
• CVE-2025-21206, published 2025-02-11. High severity, CVSS 7.3. EPSS: 0.7% chance of exploitation in the next 30 days. Visual Studio Installer Elevation of Privilege Vulnerability
• CVE-2025-21178, published 2025-01-14. High severity, CVSS 8.8. EPSS: 1.6% chance of exploitation in the next 30 days. Visual Studio Remote Code Execution Vulnerability
• CVE-2025-21172, published 2025-01-14. High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days. .NET and Visual Studio Remote Code Execution Vulnerability