CVE-2026-118147
Microsoft — Visual Studio Spoofing Vulnerability
Microsoft · CWE-295
Patch Tuesday
12
EVRS 12 of 100 Elevated
Scheduled Maintenance
Rank 2,520 of 3,373 tracked
Why it scores 12
Evidence available: 5 of 8 signalsCVSS base score 7.4.
- CISA KEVDid not apply
- RansomwareNo data
- Vendor exploitationDid not apply
- EPSSNo data
- Microsoft Exploitability IndexDid not apply
- Pre-patch disclosureDid not apply
- KEV recencyNo data
- CVSSApplied
The band answers “how soon”, not “how bad”. No data for: Ransomware, EPSS, KEV recency. Why some signals show no data
Fix
No fixed version identified yetAffected versions
Not identified by the connected sources
Remediation
Apply the vendor patch or guidance: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118147
Evidence
Each value with its source| Measure | Value | Source |
|---|---|---|
| CVSS base scoreHow severe the flaw is in itself. It does not say how likely an attack is. | 7.4 | NVD |
| FIRST EPSSFIRST's estimate of the chance this is exploited in the next 30 days, and how that ranks against all CVEs. | Not published | FIRST EPSS |
| Actively exploitedWhether a source of record has confirmed attacks using it in the wild. | Not confirmed | Patch Tuesday |
| Public exploit moduleA module existing is not the same as active exploitation. | None known | Metasploit |
| EUVD cross-referenceENISA's record: CVSS 7.4 (v3.1), assigned by microsoft. | Listed | ENISA EUVD |
Description
NVDImproper certificate validation in Visual Studio allows an unauthorized attacker to perform spoofing over a network.