Visual Studio 2019
Vendor:
First CVE: May 16, 2019 · Active for 7 years
118
Total CVEs
More Total CVEs than 99% of tracked products
16.9
Avg CVEs / Year
Higher CVE frequency than 98% of tracked products
7.5
Avg CVSS
Higher Avg CVSS than 50% of tracked products
0.8%
KEV Rate
Higher KEV Rate than 96% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Visual Studio 2019 over time
Volume of CVEsAvg CVSS Base Score
First CVE
May 16, 2019
7 years ago
Most Recent CVE
Oct 14, 2025
283 days ago
CVE Severity & Scoring
Visual Studio 2019118 CVEs
22%
75%
All CVEs352,294 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local70 (59.3%)
Network47 (39.8%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network1 (0.8%)
Attack Complexity
Low113 (95.8%)
High5 (4.2%)
Unknown0 (0.0%)
User Interaction
None61 (51.7%)
Unknown0 (0.0%)
Required57 (48.3%)
Privileges Required
Low53 (44.9%)
High0 (0.0%)
None65 (55.1%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (118 CVEs).
118 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-1147HIGH A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '. | Jul 14, 2020 | 7.8 | 98 | YES | YES |
CVE-2021-27068HIGH Visual Studio Remote Code Execution Vulnerability | May 11, 2021 | 8.8 | 55 | NO | NO |
CVE-2021-36952HIGH Visual Studio Remote Code Execution Vulnerability | Sep 15, 2021 | 7.8 | 54 | NO | NO |
CVE-2021-26701CRITICAL .NET Core Remote Code Execution Vulnerability | Feb 25, 2021 | 9.8 | 47 | NO | NO |
CVE-2019-1349HIGH A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is | Jan 24, 2020 | 8.8 | 46 | NO | NO |
CVE-2019-1350HIGH A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is | Jan 24, 2020 | 8.8 | 41 | NO | NO |
CVE-2019-1354HIGH A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is | Jan 24, 2020 | 8.8 | 40 | NO | NO |
CVE-2019-1352HIGH A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is | Jan 24, 2020 | 8.8 | 40 | NO | NO |
CVE-2021-24112CRITICAL .NET Core Remote Code Execution Vulnerability | Feb 25, 2021 | 9.8 | 32 | NO | NO |
CVE-2020-1108HIGH A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests, aka '.NET Core & .NET Framework Denial of Service Vulnerability'. | May 21, 2020 | 7.5 | 30 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (118 CVEs).
CISA KEV
1 CVE
0.8% of CVEs· 96th percentile
Metasploit
1 CVE
0.8% of CVEs· 96th percentile
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
1 CVE
0.8% of CVEs· 87th percentile
Social Chatter
Signals from CVEs in this product scope (118 CVEs).
Media Mentions
Signals from CVEs in this product scope (118 CVEs).
Top CNAs Publishing CVEs For Visual Studio 2019
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 8.9 | 1 | 7.8 | 1.4% | 0 | 0 |
| 8.10 | 5 | 6.8 | 3.2% | 0 | 0 |
| 16.9 | 5 | 8.5 | 1.9% | 0 | 0 |
| 16.8 | 4 | 6.8 | 1.8% | 0 | 0 |
| 16.7 | 2 | 7.5 | 2.8% | 0 | 0 |
| 16.5.0 | 2 | 5.5 | 0.8% | 0 | 0 |
| 16.5 | 1 | 7.5 | 11.7% | 0 | 0 |
| 16.4 | 4 | 6.2 | 4.5% | 0 | 0 |
| 16.3 | 1 | 6.5 | 3.1% | 0 | 0 |
| 16.2 | 2 | 7.5 | 1.2% | 0 | 0 |
| 16.11 | 5 | 8.5 | 1.9% | 0 | 0 |
| 16.1 | 1 | 5.0 | 1.8% | 0 | 0 |
| 16.0 | 9 | 6.6 | 2.9% | 0 | 0 |