The vulnerability arises from improper certificate validation in Microsoft Visual Studio, allowing an attacker without credentials to impersonate a trusted server or client during network communication. Based on the description, the attacker could spoof a network endpoint, redirecting or intercepting traffic between Visual Studio and external services; this can compromise the confidentiality and integrity of development data, though it does not grant direct code execution.

Microsoft Visual Studio 2017 version 15.9, Visual Studio 2019 version 16.11, Visual Studio 2022 version 17.14, and Visual Studio 2026 version 18.11 are affected by improper handling of SSL/TLS certificates during network operations.

The CVSS score of 7.4 indicates medium‑to‑high severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, so the real‑world likelihood of exploitation is uncertain. Based on the description, the attack vector likely involves an attacker inserting themselves between Visual Studio and the target service, enabling a man‑in‑the‑middle attack without requiring local code execution. Patching mitigates the risk.