SYS::ONLINE
Wasteland.
Briefs1677
Issues21
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-47281 2026-06-09

CVE-2026-47281: Critical Privilege Escalation Flaw in Visual Studio Code

"Microsoft has disclosed CVE-2026-47281, a critical (CVSS 9.6) authentication and authorization flaw in Visual Studio Code that allows an unauthorized attacker to elevate privileges over a network."

Microsoft has disclosed CVE-2026-47281, a critical (CVSS 9.6) authentication and authorization flaw in Visual Studio Code that allows an unauthorized attacker to elevate privileges over a network.

What Is It

CVE-2026-47281 is a privilege escalation vulnerability in Microsoft Visual Studio Code rooted in missing authentication and authorization controls. According to Microsoft's advisory, the flaw allows an unauthorized attacker to elevate privileges over a network. The CVE is associated with multiple weakness classes that point to broken access control rather than input handling: missing authentication for a critical function (CWE-306), use of hard-coded credentials (CWE-798), and missing authorization (CWE-862).

The vulnerability carries a CVSS 3.1 base score of 9.6 (CRITICAL), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.

Why It Matters

The score reflects a serious risk profile. The flaw is exploitable over the network (AV:N) with low attack complexity (AC:L) and requires no privileges (PR:N), though it does require user interaction (UI:R). Critically, the scope is changed (S:C), meaning a successful attack can affect resources beyond the vulnerable component. Impact across confidentiality, integrity, and availability is rated HIGH, indicating an attacker could fully compromise affected systems.

What's Vulnerable

The affected product is Microsoft Visual Studio Code. The supplied NVD record does not enumerate specific affected versions or CPEs, and the entry is currently listed as "Awaiting Analysis." Refer to Microsoft's update guide for precise version and build details.

Patch Status

No CISA KEV entry was supplied for this CVE, so there is no confirmation of active exploitation at this time. The vulnerability was published on 2026-06-09 and is sourced directly from Microsoft ([email protected]). Microsoft's Security Update Guide is the authoritative reference for available fixes and remediation guidance; administrators and developers should consult it and apply updates as released.

Sources