Visual Studio: four branches need a certificate-validation fix

The attacker must be between the PC and the requested resource

The October Microsoft document, in the CVE-2026-118147 record published on 30 October, describes improper certificate validation. Its FAQ says the attacker must insert themselves into the network path between the target and the requested resource to read or modify communications. This is a machine-in-the-middle, or MITM, attack.

Microsoft rates the flaw Important and records Exploited: No in that entry. This reports the vendor’s stated position; it proves neither the absence of all attacks nor the status of another CVE. We did not reproduce the mechanism.

Each branch has its own fixed version

The 2 November CERT-FR notice and the FixedBuild fields in Microsoft’s document agree on the four versions below. Identify the installation’s year and branch before comparing its full version number. A 2019 version is not fixed merely because its number looks higher than a 2017 one.

These versions apply to Visual Studio, the development environment named in the advisories. They are not an update instruction for Visual Studio Code or every extension with Claude in its name.

Scroll the table sideways to read every column.

Update the IDE you actually use

Save your work, use the update route for your installation and complete any requested restart. On a managed PC, give the administrator the branch and version. Afterwards, check the version of the IDE you actually launch, especially when several editions coexist. This is a maintenance recommendation, not a test of the fixes.

Brotli CVE-2026-111497 also has Visual Studio entries, but its versions are not the threshold for this new flaw. For example, Microsoft’s document lists 17.14.43 for Brotli; CVE-2026-118147 requires 17.14.44. An update sufficient for the first advisory can therefore still predate the second.

• Brotli: distinguish the library from the products using it↗
• The Cursor incident involves a different software distribution↗