CVE-2026-47281
9.6
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 6.0
Source: secure@microsoft.com (Secondary)
Description
Missing authorization in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
Affected (1)
Products: Microsoft: Visual Studio Code
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| From 1.0.0 to 1.123.1 |
Related CWEs
CWE-306
Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-798
Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key.
CWE-862
Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
References (1)
Source: secure@microsoft.com
Vendor Advisory
Timeline
No history available yet.