VS
Product
Visual Studio 2022
On CISA KEVExploited in the wild
156
CVEs
2
On KEV
9.9
Max CVSS
4
New 30D
Severity mix
Critical 7High 116Medium 33Low 0
Watch
Add Visual Studio 2022 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-44487 In wildKEV | 7.5 | Oct 10 | HTTP/2 Rapid Reset Attack Vulnerability Affected: 17.0 before 17.2.20; 17.4 before 17.4.12; 17.6 before 17.6.8; 17.7 before 17.7.5 |
| CVE-2023-38180 In wildKEV | 7.5 | Aug 8 | .NET and Visual Studio Denial of Service Vulnerability Affected: 17.2.0 before 17.2.18; 17.4.0 before 17.4.10; 17.6.0 before 17.6.6 |
| CVE-2025-55315 | 9.9 | Oct 14 | Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network Affected: 17.10.0 before 17.10.20; 17.12.10 before 17.12.13; 17.14.0 before 17.14.17 |
| CVE-2026-47304 | 9.8 | Jul 14 | .NET Security Feature Bypass Vulnerability Affected: 17.12.0 before 17.12.22; 17.14.0 before 17.14.36 |
| CVE-2024-43498 | 9.8 | Nov 12 | .NET and Visual Studio Remote Code Execution Vulnerability Affected: 17.6 before 17.6.21; 17.8 before 17.8.16; 17.10.0 before 17.10.9; 17.11.0 before 17.11.6 |
| CVE-2024-0057 | 9.8 | Jan 9 | NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability Affected: 17.2 before 17.2.23; 17.4 before 17.4.15; 17.6 before 17.6.11; 17.8 before 17.8.4 |
| CVE-2023-36049 | 9.8 | Nov 14 | .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability Affected: 17.2 before 17.2.22; 17.4 before 17.4.14; 17.6 before 17.6.10; 17.7 before 17.7.7 |
| CVE-2023-36758 | 9.8 | Sep 12 | Visual Studio Elevation of Privilege Vulnerability Affected: 17.7 through 17.7.4 |
| CVE-2026-88092 | 9.4 | Oct 13 | ASP.NET Core Tampering Vulnerability Affected: 17.14.0 before 17.14.42 |
| CVE-2026-96957 | 8.8 | Oct 13 | .NET Security Feature Bypass Vulnerability Affected: 17.14.0 before 17.14.42 |
| CVE-2026-71328 | 8.8 | Sep 8 | .NET and Visual Studio Remote Code Execution Vulnerability Affected: 17.14.0 before 17.14.40 |
| CVE-2026-69439 | 8.8 | Sep 8 | .NET and Visual Studio Elevation of Privilege Vulnerability Affected: 17.14.0 before 17.14.40 |
| CVE-2026-47303 | 8.8 | Jul 14 | ASP.NET Core Elevation of Privilege Vulnerability Affected: 17.12.0 before 17.12.22; 17.14.0 before 17.14.36 |
| CVE-2026-47300 | 8.8 | Jul 14 | ASP.NET Core Elevation of Privilege Vulnerability Affected: 17.12.0 before 17.12.22; 17.14.0 before 17.14.36 |
| CVE-2026-21256 | 8.8 | Feb 10 | Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code over a… Affected: 17.14.0 before 17.14.26 |
| CVE-2025-49739 | 8.8 | Jul 8 | Improper link resolution before file access ('link following') in Visual Studio allows an unauthorized attacker to elevate privileges over a network Affected: 17.8.0 before 17.8.23; 17.10.0 before 17.10.17; 17.12.0 before 17.12.10; 17.14.0 before 17.14.8 |
| CVE-2025-21178 | 8.8 | Jan 14 | Visual Studio Remote Code Execution Vulnerability Affected: 17.6.0 before 17.6.22; 17.8.0 before 17.8.17; 17.10.0 before 17.10.10; 17.12.0 before 17.12.4 |
| CVE-2024-28938 | 8.8 | Apr 9 | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Affected: 17.4.0 before 17.4.18; 17.6.0 before 17.6.14; 17.8.0 before 17.8.9; 17.9.0 before 17.9.6 |
| CVE-2024-28937 | 8.8 | Apr 9 | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Affected: 17.4.0 before 17.4.18; 17.6.0 before 17.6.14; 17.8.0 before 17.8.9; 17.9.0 before 17.9.6 |
| CVE-2024-28936 | 8.8 | Apr 9 | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Affected: 17.4.0 before 17.4.18; 17.6.0 before 17.6.14; 17.8.0 before 17.8.9; 17.9.0 before 17.9.6 |
| CVE-2024-28935 | 8.8 | Apr 9 | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Affected: 17.4.0 before 17.4.18; 17.6.0 before 17.6.14; 17.8.0 before 17.8.9; 17.9.0 before 17.9.6 |
| CVE-2024-28934 | 8.8 | Apr 9 | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Affected: 17.4.0 before 17.4.18; 17.6.0 before 17.6.14; 17.8.0 before 17.8.9; 17.9.0 before 17.9.6 |
| CVE-2024-28933 | 8.8 | Apr 9 | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Affected: 17.4.0 before 17.4.18; 17.6.0 before 17.6.14; 17.8.0 before 17.8.9; 17.9.0 before 17.9.6 |
| CVE-2024-28932 | 8.8 | Apr 9 | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Affected: 17.4.0 before 17.4.18; 17.6.0 before 17.6.14; 17.8.0 before 17.8.9; 17.9.0 before 17.9.6 |
| CVE-2024-28931 | 8.8 | Apr 9 | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Affected: 17.4.0 before 17.4.18; 17.6.0 before 17.6.14; 17.8.0 before 17.8.9; 17.9.0 before 17.9.6 |
| CVE-2024-28930 | 8.8 | Apr 9 | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Affected: 17.4.0 before 17.4.18; 17.6.0 before 17.6.14; 17.8.0 before 17.8.9; 17.9.0 before 17.9.6 |
| CVE-2024-28929 | 8.8 | Apr 9 | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Affected: 17.4.0 before 17.4.18; 17.6.0 before 17.6.14; 17.8.0 before 17.8.9; 17.9.0 before 17.9.6 |
| CVE-2022-35827 | 8.8 | Aug 9 | Visual Studio Remote Code Execution Vulnerability Affected: 17.0; 17.2 |
| CVE-2022-35826 | 8.8 | Aug 9 | Visual Studio Remote Code Execution Vulnerability Affected: 17.0; 17.2 |
| CVE-2022-35825 | 8.8 | Aug 9 | Visual Studio Remote Code Execution Vulnerability Affected: 17.0; 17.2 |
| CVE-2022-35777 | 8.8 | Aug 9 | Visual Studio Remote Code Execution Vulnerability Affected: 17.0; 17.2 |
| CVE-2021-43877 | 8.8 | Dec 15 | ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability Affected: 17.0 |
| CVE-2024-0056 | 8.7 | Jan 9 | Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability Affected: 17.2 before 17.2.23; 17.4 before 17.4.15; 17.6 before 17.6.11; 17.8 before 17.8.4 |
| CVE-2026-50528 | 8.2 | Jul 14 | .NET Security Feature Bypass Vulnerability Affected: 17.12.0 before 17.12.22; 17.14.0 before 17.14.36 |
| CVE-2026-69805 | 8.1 | Sep 8 | .NET Elevation of Privilege Vulnerability Affected: 17.14.0 before 17.14.40 |
| CVE-2024-38229 | 8.1 | Oct 8 | .NET and Visual Studio Remote Code Execution Vulnerability Affected: 17.6.0 before 17.6.20; 17.8.0 before 17.8.15; 17.10.0 before 17.10.8; 17.11.0 before 17.11.5 |
| CVE-2024-35264 | 8.1 | Jul 9 | .NET and Visual Studio Remote Code Execution Vulnerability Affected: 17.4.0 before 17.4.21; 17.6.0 before 17.6.17; 17.8.0 before 17.8.12; 17.10.0 before 17.10.4 |
| CVE-2023-33170 | 8.1 | Jul 11 | ASP.NET and Visual Studio Security Feature Bypass Vulnerability Affected: 17.0 before 17.0.23; 17.2.0 before 17.2.17; 17.4.0 before 17.4.9; 17.6.0 before 17.6.5 |
| CVE-2023-33127 | 8.1 | Jul 11 | .NET and Visual Studio Elevation of Privilege Vulnerability Affected: 17.0 before 17.0.23; 17.2.0 before 17.2.17; 17.4.0 before 17.4.9; 17.6.0 before 17.6.5; 17.3 |
| CVE-2026-21257 | 8.0 | Feb 10 | Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an authorized attacker to elevate privileges over a… Affected: 17.14.0 before 17.14.26 |
| CVE-2025-26646 | 8.0 | May 13 | External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network Affected: 17.8.0 before 17.8.21; 17.10.0 before 17.10.15; 17.12.0 before 17.12.8; 17.13.0 before 17.13.7 |
| CVE-2026-70354 | 7.8 | Aug 11 | .NET Core Remote Code Execution Vulnerability Affected: 17.14.0 before 17.14.38 |
| CVE-2026-62886 | 7.8 | Aug 11 | .NET Elevation of Privilege Vulnerability Affected: 17.14.0 before 17.14.38 |
| CVE-2026-62871 | 7.8 | Aug 11 | .NET Elevation of Privilege Vulnerability Affected: 17.14.0 before 17.14.38 |
| CVE-2026-62909 | 7.8 | Aug 11 | .NET Elevation of Privilege Vulnerability Affected: 17.14.0 before 17.14.38 |
| CVE-2026-50646 | 7.8 | Jul 14 | .NET Framework Remote Code Execution Vulnerability Affected: 17.12.0 before 17.12.22; 17.14.0 before 17.14.36 |
| CVE-2026-47305 | 7.8 | Jul 14 | Visual Studio Remote Code Execution Vulnerability Affected: 17.12.0 before 17.12.22; 17.14.0 before 17.14.36 |
| CVE-2025-53773 | 7.8 | Aug 12 | Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code locally Affected: 17.14.0 before 17.14.12 |
| CVE-2025-32702 | 7.8 | May 13 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an unauthorized attacker to execute code locally Affected: 17.8.0 before 17.8.21; 17.10.0 before 17.10.14; 17.12.0 before 17.12.8; 17.13.0 before 17.13.7 |
| CVE-2024-43590 | 7.8 | Oct 8 | Visual C++ Redistributable Installer Elevation of Privilege Vulnerability Affected: 17.6.0 before 17.6.20; 17.8.0 before 17.8.15; 17.10.0 before 17.10.8; 17.11.0 before 17.11.5 |