In a significant update this month, Microsoft has addressed 24 Common Vulnerabilities and Exposures (CVEs) within its developer tooling, with 23 classified as important and one deemed critical. The primary focus of these updates centers around security feature bypasses, which account for eight of the CVE entries, while remote code execution and information disclosure vulnerabilities each contribute four entries to the list.
- The critical entry, CVE-2026-34182, boasts a CVSS score of 9.1. This vulnerability affects CMS AuthEnvelopedData processing, enabling the acceptance of forged messages. It impacts Visual Studio versions from 2017 through 2022.
- Interestingly, the highest-scoring entry in this release is CVE-2026-81376, a security feature bypass in Visual Studio Code, which carries a CVSS score of 9.6 despite being rated as important. This distinction serves as a reminder that severity labels and CVSS scores address different aspects of vulnerability assessment.
- Visual Studio Code, along with its Copilot extensions, accounts for ten of the entries, predominantly related to security feature bypasses. Developers are advised to update the editor and verify that workspace trust prompts, extension installations, and remote sessions function as intended.
- The .NET framework has also seen updates across all three supported lines, with SDK versions 8.0.131 and 8.0.425, 9.0.121 and 9.0.318, and 10.0.112 and 10.0.401 now available. Developers should install these updates and run a representative project to check for any regressions. Additionally, it’s prudent to keep the upcoming 10 November date for .NET 8 in mind during this process.
- Monthly rollups for the .NET Framework have been released for various operating systems, including Windows Server 2012 (KB5126147), Server 2012 R2 (KB5126148), Windows 10 1809 (KB5126144), 21H2 (KB5126145), 22H2 (KB5126146), and Server 2022 (KB5126149). Notably, the 4.7.2 package for Windows 10 1607 is still pending, meaning that environments on this version will not complete their Framework patching this cycle.
These updates should be integrated into the standard release schedule, following this month’s priorities for Windows, Office, and SQL Server. As developers navigate these changes, it’s essential to remain aware of the 10 November date for .NET 8 and PowerShell 7.4, as this month’s patch does not extend either branch.
Adobe (and third-party updates)
September marks the largest release of the year for Adobe, and while the sheer volume of 963 CVEs may seem overwhelming, it is the 55 entries flagged by Microsoft as high risk—primarily in printing and fonts—that warrant closer attention. Adobe has released two builds for Acrobat, with only the latter serving as a security update, alleviating concerns for users.
Among the CVEs republished by Microsoft, 25 are not originally from Microsoft itself, highlighting the complexity of the landscape. A mere version number often provides little insight into the work required. Drawing from insights into Microsoft’s operational patterns over the summer, predictions for next month suggest that while October may not match the scale of September, November is poised to bring significant updates. The anticipation builds as the community awaits what may come next.
