Microsoft has disclosed CVE-2026-47281, a critical (CVSS 9.6) authentication and authorization flaw in Visual Studio Code that allows an unauthorized attacker to elevate privileges over a network.
What Is It
CVE-2026-47281 is a privilege escalation vulnerability in Microsoft Visual Studio Code rooted in missing authentication and authorization controls. According to Microsoft's advisory, the flaw allows an unauthorized attacker to elevate privileges over a network. The CVE is associated with multiple weakness classes that point to broken access control rather than input handling: missing authentication for a critical function (CWE-306), use of hard-coded credentials (CWE-798), and missing authorization (CWE-862).
The vulnerability carries a CVSS 3.1 base score of 9.6 (CRITICAL), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.
Why It Matters
The score reflects a serious risk profile. The flaw is exploitable over the network (AV:N) with low attack complexity (AC:L) and requires no privileges (PR:N), though it does require user interaction (UI:R). Critically, the scope is changed (S:C), meaning a successful attack can affect resources beyond the vulnerable component. Impact across confidentiality, integrity, and availability is rated HIGH, indicating an attacker could fully compromise affected systems.
What's Vulnerable
The affected product is Microsoft Visual Studio Code. The supplied NVD record does not enumerate specific affected versions or CPEs, and the entry is currently listed as "Awaiting Analysis." Refer to Microsoft's update guide for precise version and build details.
Patch Status
No CISA KEV entry was supplied for this CVE, so there is no confirmation of active exploitation at this time. The vulnerability was published on 2026-06-09 and is sourced directly from Microsoft ([email protected]). Microsoft's Security Update Guide is the authoritative reference for available fixes and remediation guidance; administrators and developers should consult it and apply updates as released.