CMS AuthEnvelopedData Processing May Accept Forged Messages

• Microsoft Visual Studio 2022 version 17.14

• Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)

• Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)

• azl3 edk2 20240524git3e722403cd16-17 on Azure Linux 3.0

• azl3 openssl 3.3.5-5 on Azure Linux 3.0

• Microsoft Visual Studio 2026 version 18.9

SecurityAlert records field-level changes from the point we begin following a bulletin. Earlier vendor changes may not have a field-by-field record.

1. Oct 11, 2026 at 10:05 AM UTC
   • Removed affected products: Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8), Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10), Microsoft Visual Studio 2022 version 17.14, Microsoft Visual Studio 2026 version 18.9.
   • Removed fixed versions: 15.9.83, 16.11.60, 17.14.40, 18.9.3.
   • The vendor changed its remediation guidance.

1. Jun 16, 2026 at 2:14 AM UTC
   Published by Microsoft Security Response Center

   The publication date reported by the vendor.

2. Sep 8, 2026 at 7:00 AM UTC
   Updated by Microsoft Security Response Center

   The vendor changed the advisory after it was first published.

3. Sep 8, 2026 at 7:15 PM UTC
   Added to SecurityAlert

   We collected the advisory from the official source.

4. Oct 28, 2026 at 3:45 AM UTC
   Confirmed at the source

   Our collector saw this advisory during a later source check.