> Visual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)

A . is all you need! Today Microsoft shipped the patch for a vulnerability in Visual Studio Copilot that I reported in August. Microsoft classified it as Important severity Remote Code Execution vulnerability. At the root cause it allows Copilot in Visual Studio or SQL Server Management Studio to bypass a path validation check and write to its own settings and configuration files. This allows Copilot to escape containment restrictions and achieve arbitrary command execution.