CVE-2026-103572

HighCVSS 8.8/10Last modified Oct 13, 2026

Description

Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code over a network.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 13, 2026
Last modified: Oct 13, 2026
NVD status: Undergoing Analysis

Related CVEs from 2026

CVE-2026-1035758.8Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.CVE-2026-1035766.5Url redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perfo CVE-2026-1035777.5Insecure default variable initialization in Microsoft QUIC allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-1035786.8Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack.CVE-2026-1035827.5Unbounded memory allocation and missing frame size validation in Apache NMS ActiveMQ (the .NET OpenWire client, package Apache.NMS.ActiveMQ)CVE-2026-1035841.1Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki CommonsMet CVE-2026-1035851.2Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki MediaSearc CVE-2026-1035875.4QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation System Book Now search, w CVE-2026-1035885.4QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the exceptions field of the back-office Transplant a module CVE-2026-1035895.4QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape room_CVE-2026-1035905.4QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's length of stay fields. A CVE-2026-1035917.5DeepWiki-Open through commit d92819a contains an unauthenticated arbitrary file read vulnerability in the GET /codemap/file endpoint via the