First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-118147

HighCVSS 7.4/10Last modified Nov 7, 2026

Description

Improper certificate validation in Visual Studio allows an unauthorized attacker to perform spoofing over a network.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Microsoft	Microsoft Visual Studio 2017 version 15.9	>= 15.9.0, < 15.9.84
Microsoft	Microsoft Visual Studio 2019 version 16.11	>= 16.11.0, < 16.11.62
Microsoft	Microsoft Visual Studio 2022 version 17.14	>= 17.14.0, < 17.14.44
Microsoft	Microsoft Visual Studio 2026 version 18.11	>= 18.11.0, < 18.11.3

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118147

Timeline

Published: Oct 31, 2026
Last modified: Nov 7, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1181487.5Improper authentication in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network.CVE-2026-1181498.8Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an authorized attacker to execute code over a CVE-2026-118155.3An attacker who intercepts and tampers with traffic between the client application and the API Gateway server could potentially deserialize CVE-2026-1181508.8Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a net CVE-2026-1181517.2External control of file name or path in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.CVE-2026-1181526.5Cross-site request forgery (csrf) in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.CVE-2026-1181537.5Inefficient algorithmic complexity in Microsoft Exchange Server allows an unauthorized attacker to deny service over a network.CVE-2026-1181548.8Reliance on untrusted inputs in a security decision in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a CVE-2026-1181577.2Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.CVE-2026-118168.1Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in `keras/src/utils/file CVE-2026-1181646.4The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting CVE-2026-1181656.8The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in its Classic lightbox before inserting it

CVE-2026-118147: High severity, CVSS 7.4 | Vulnix