Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources, documents or advisories need attention: 275/275 feeds/APIs · 467/469 docs · 7/9 advisories · checked 01:34 UTC Customize Public modeDiscuss ChangeIntel on Discord

Recorded 21 Oct 2026 at 21:47 UTC. This is what ChangeIntel recorded, including the title, summary, facts and links. It is not a statement of the source's current position. See the latest record.

The historical field “Public exploit code” recorded Nuclei detection-template membership. It did not establish exploit availability. The original recorded fields remain below.

The historical “Publicly disclosed: No” field could represent a missing MSRC assessment. It does not establish that the vulnerability was undisclosed. The original recorded fields remain below.

Visual Studio Remote Code Execution Vulnerability

Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.

What it said

CVE
CVE-2026-77906
Severity
Important
CVSS base score
8.8
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Impact
Remote Code Execution
Exploitation detected
Not reported by MSRC
Publicly disclosed
No
Exploitability
Exploitation Less Likely
Component
Visual Studio
Weakness
CWE-122: Heap-based Buffer Overflow
Issued by
Microsoft
Customer action
Required: apply the update
Affected products
Microsoft Visual Studio 2026 version 18.9
Updates that fix it
No KB listed
CISA KEV
Not listed in the collected catalog
EPSS
0.8%; scored 21 Oct 2026
Public exploit code
No Nuclei template listed
Published
8 Sep 2026 07:00 UTC
Last revised
8 Sep 2026 07:00 UTC
Revision note
Information published.

Source evidence when recorded

Microsoft security releases
Complete at observationRead 21 Oct 2026 at 21:46 UTC
CISA KEV
Complete at observationRead 21 Oct 2026 at 21:46 UTC
FIRST EPSS
Complete at observationRead 21 Oct 2026 at 21:46 UTC
Public detection templates (Nuclei)
Complete at observationRead 21 Oct 2026 at 21:46 UTC

Coverage describes the sources at this observation. A complete read then does not establish their current position.

Page history

Changes are dated when recorded; day views use the last saved version from that UTC day, and citations stay fixed.

Cite this version
Field-level log (9)

Up to 100 recent field edits are shown; older edits may be outside retention.

  1. 21 Oct 2026 · 21:47:24 UTC EPSS0.8%; scored 20 Oct 2026 → 0.8%; scored 21 Oct 2026
  2. 20 Oct 2026 · 20:53:31 UTC EPSS0.8%; scored 19 Oct 2026 → 0.8%; scored 20 Oct 2026
  3. 19 Oct 2026 · 15:12:40 UTC EPSS0.8%; scored 18 Oct 2026 → 0.8%; scored 19 Oct 2026
  4. 18 Oct 2026 · 14:54:30 UTC EPSS0.8%; scored 16 Oct 2026 → 0.8%; scored 18 Oct 2026
  5. 18 Oct 2026 · 14:54:30 UTC Link: September 2026/security?release=2026-Sep#cves
  6. 16 Oct 2026 · 16:13:25 UTC EPSS0.8%; scored 15 Oct 2026 → 0.8%; scored 16 Oct 2026
  7. 15 Oct 2026 · 21:30:54 UTC EPSS0.8%; scored 14 Oct 2026 → 0.8%; scored 15 Oct 2026
  8. 15 Oct 2026 · 01:07:54 UTC EPSS0.8%; scored 13 Oct 2026 → 0.8%; scored 14 Oct 2026
  9. 14 Oct 2026 · 11:22:42 UTC Source coverage: msrc-cvrfIncomplete → Current
ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 11 Nov 01:34 UTC · 275 of 275 readable · 273 fully read · documentation 467/469 current