CVE-2026-81376 – Microsoft Visual Studio Code
CVSS 9.6
CRITICAL
[2] Critical – Same Day Deployment
“When the developer's editor becomes the attacker's doorway, every repository and credential on that workstation is up for grabs.”
Microsoft's Visual Studio Code update fixes two vulnerabilities, one Critical and one High. CVE-2026-81376 has a CVSS score of 9.6, Critical severity. It is a protection mechanism failure that lets attackers get around security controls built into the editor. CVE-2026-78461 has a CVSS score of 7.4, High severity. It is a path traversal flaw that allows elevation of privilege on the affected system.
Developer workstations hold source code, signing keys and cloud credentials, so these flaws put high-value assets at risk. Deploy the update to all Visual Studio Code installations on a same-day schedule.
Key Details
- Affected Product
- Microsoft Visual Studio Code
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- Required
- CWE Classification
- CWE-693
Patch this CVE on all your endpoints in under 5 minutes.
First 200 endpoints are free forever, scale as needed.