CVE-2026-47281
A missing authorization flaw in Microsoft Visual Studio Code lets an attacker who can reach the application over a network raise their privileges without needing any authentication. The vulnerability is rated critical with a CVSS base score of 9.6, reflecting high impact on confidentiality, integrity, and availability. No official patch or exploit is currently documented in the provided sources.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Users of Microsoft Visual Studio Code.
Real-world impact
An attacker could gain elevated privileges on the affected system, potentially allowing them to install software, view or change data, or create new accounts.
Why this severity
The CVSS score of 9.6 (Critical) is driven by the attack being network‑based, low complexity, requiring no privileges, and resulting in high impacts to confidentiality, integrity, and availability.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jun 9, 2026 · Jun 9, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- msrc.microsoft.com/update-guide/vulnerability/…vendor advisory