Visual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)

Microsoft has shipped a patch for a remote code execution vulnerability (CVE-2026-103572) in Visual Studio Copilot and SQL Server Management Studio. The flaw let Copilot bypass a path validation check, write to its own settings and configuration files, and achieve arbitrary command execution.