[UPDATE] [high] Microsoft DeveloperTools: Multiple vulnerabilities
An attacker can exploit multiple vulnerabilities in Microsoft Visual Studio Code, Microsoft ASP.NET, Microsoft .NET, and Microsoft Visual Studio 2026 to gain administrative privileges, manipulate data, disclose confidential information, or bypass authentication.
CSIRTS triage
- What
- Multiple vulnerabilities in Microsoft Developer Tools can be exploited for various attacks.
- Who is affected
- Users of Microsoft Developer Tools are affected.
- Urgency
- Remediation is important due to the potential for serious security breaches.
- Action
- Update Microsoft Developer Tools to the latest version to address these vulnerabilities.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch DeveloperTools
Get an email when a new DeveloperTools advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1845
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-403760.67% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 48% of all scored CVEs.
- Low exploitation riskCVE-2026-454820.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 27% of all scored CVEs.
- Low exploitation riskCVE-2026-454900.38% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 31% of all scored CVEs.
- Low exploitation riskCVE-2026-454910.39% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 32% of all scored CVEs.
- Moderate exploitation riskCVE-2026-455912.4% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 83% of all scored CVEs.
- Low exploitation riskCVE-2026-456440.55% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 43% of all scored CVEs.
- Low exploitation riskCVE-2026-472810.76% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 52% of all scored CVEs.
- Low exploitation riskCVE-2026-472840.92% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 57% of all scored CVEs.
- Low exploitation riskCVE-2026-472870.79% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 53% of all scored CVEs.
- Low exploitation riskCVE-2026-472920.44% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 36% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-40376 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-45482 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-45490 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-45491 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-45591 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-45644 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-47281 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-47284 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-47287 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-47292 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-48569 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- unknownMultiple vulnerabilities in Tenable Identity Exposure (June 24, 2026)cert-fr-avis
- highCVE-2026-40376: Visual Studio Code Elevation of Privilege Vulnerabilitymsrc
- criticalCVE-2026-47281: Visual Studio Code Elevation of Privilege Vulnerabilitymsrc
- highCVE-2026-48569: Visual Studio Code Security Feature Bypass Vulnerabilitymsrc
- mediumCVE-2026-47284: Visual Studio Code Information Disclosure Vulnerabilitymsrc
- mediumCVE-2026-47287: Visual Studio Code Tampering Vulnerabilitymsrc
- highCVE-2026-47292: Visual Studio Code MSSQL Extension Remote Code Execution Vulnerabilitymsrc
- highCVE-2026-45490: .NET SDK Elevation of Privilege Vulnerabilitymsrc
- mediumCVE-2026-45491: .NET Tampering Vulnerabilitymsrc
- highCVE-2026-45482: Microsoft Visual Studio Code CoPilot Chat Security Feature Bypass Vulnerabilitymsrc
- highCVE-2026-45591: ASP.NET Core Denial of Service Vulnerabilitymsrc
- highCVE-2026-45644: Microsoft Live Share Canvas SDK Elevation of Privilege Vulnerabilitymsrc
Recent advisories for Microsoft DeveloperTools
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- high[NEW] [high] Microsoft DeveloperTools: Multiple vulnerabilitiescert-bund · 2026-07-23
More from CERT-Bund (BSI) Security Advisories
- medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow denial of service2026-07-31
- medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow Denial of Service2026-07-31
- medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow denial of service2026-07-31
- medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities2026-07-31
- medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow unspecified attack2026-07-31