Security Updates for Microsoft Visual Studio Products 17.14.42 and 18.10.4 (October 2026)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(366085);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/16");

  script_cve_id(
    "CVE-2026-58280",
    "CVE-2026-66822",
    "CVE-2026-69651",
    "CVE-2026-70007",
    "CVE-2026-70035",
    "CVE-2026-70159",
    "CVE-2026-70161",
    "CVE-2026-70162",
    "CVE-2026-70165",
    "CVE-2026-70174",
    "CVE-2026-70175",
    "CVE-2026-70179",
    "CVE-2026-70181",
    "CVE-2026-70183",
    "CVE-2026-70186",
    "CVE-2026-70188",
    "CVE-2026-70190",
    "CVE-2026-70194",
    "CVE-2026-70196",
    "CVE-2026-70197",
    "CVE-2026-83520",
    "CVE-2026-84008",
    "CVE-2026-85363",
    "CVE-2026-85790",
    "CVE-2026-87697",
    "CVE-2026-88092",
    "CVE-2026-92707",
    "CVE-2026-96222",
    "CVE-2026-96224",
    "CVE-2026-96225",
    "CVE-2026-96229",
    "CVE-2026-96230",
    "CVE-2026-96231",
    "CVE-2026-96232",
    "CVE-2026-96234",
    "CVE-2026-96235",
    "CVE-2026-96236",
    "CVE-2026-96237",
    "CVE-2026-96238",
    "CVE-2026-96957",
    "CVE-2026-102869",
    "CVE-2026-102870",
    "CVE-2026-103572",
    "CVE-2026-105016"
  );
  script_xref(name:"IAVA", value:"2026-A-1134");

  script_name(english:"Security Updates for Microsoft Visual Studio Products 17.14.42 and 18.10.4 (October 2026)");

  script_set_attribute(attribute:"synopsis", value:
"The Microsoft Visual Studio Products are affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The Microsoft Visual Studio Products are missing security updates. It is,
therefore, affected by multiple vulnerabilities:

  - Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over
    a network. (CVE-2026-105016)

  - Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core
    allows an unauthorized attacker to perform tampering over a network. (CVE-2026-88092)

  - Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core
    allows an unauthorized attacker to bypass a security feature over a network. (CVE-2026-70188)

Note that Nessus has not tested for these issues but has instead relied only on the application's
self-reported version number.");
  # https://learn.microsoft.com/en-us/visualstudio/releases/2026/release-history
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?afd5face");
  # https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-history
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f0f0c75d");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102869");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102870");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-103572");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105016");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58280");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66822");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69651");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70007");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70035");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70159");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70161");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70162");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70165");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70174");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70175");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70179");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70181");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70183");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70186");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70188");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70190");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70194");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70196");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70197");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83520");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84008");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85363");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85790");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-87697");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88092");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-92707");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96222");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96224");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96225");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96229");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96230");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96231");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96232");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96234");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96235");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96236");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96237");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96238");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96957");
  script_set_attribute(attribute:"solution", value:
"Microsoft has released the following security updates to address this issue:
    - Update 17.14.42 for Visual Studio 2022
    - Update 18.10.4 for Visual Studio 2026");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-96957");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-105016");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(22, 59, 79, 94, 122, 125, 183, 190, 201, 290, 295, 346, 347, 358, 362, 405, 407, 416, 444, 502, 640, 674, 770, 787, 829, 833, 843, 1325);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/15");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:visual_studio");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows : Microsoft Bulletins");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ms_bulletin_checks_possible.nasl", "microsoft_visual_studio_installed.nbin");
  script_require_keys("SMB/MS_Bulletin_Checks/Possible", "installed_sw/Microsoft Visual Studio", "SMB/Registry/Enumerated");
  script_require_ports(139, 445, "Host/patch_management_checks");

  exit(0);
}

include('vcf_extras_visual_studio.inc');

get_kb_item_or_exit('SMB/Registry/Enumerated');

var app_info = vcf::visual_studio::get_app_info();

# NB: fixed_version is the actual build number; the value in parentheses in
# fixed_display is the MSRC channel version.
var constraints = [
  {
    'product': '2022',
    'min_version': '17.14',
    'fixed_version': '17.14.37806.7',
    'fixed_display': '17.14.37806.7 (17.14.42)'
  },
  {
    'product': '2026',
    'min_version': '18.10',
    'fixed_version': '18.10.12306.391',
    'fixed_display': '18.10.12306.391 (18.10.4)'
  }
];

vcf::visual_studio::check_version_and_report(
  app_info: app_info,
  constraints: constraints,
  severity: SECURITY_HOLE
);