Microsoft has disclosed CVE-2026-81376, a critical (CVSS 9.6) security feature bypass in Visual Studio Code that lets an unauthorized remote attacker defeat a protection mechanism when a user is tricked into interacting with attacker-supplied content.
What Is It
CVE-2026-81376 is an incomplete comparison with missing factors in Visual Studio Code. Per Microsoft's advisory, the flaw "allows an unauthorized attacker to bypass a security feature over a network." It is classified under CWE-693 (Protection Mechanism Failure) and CWE-1023 (Incomplete Comparison with Missing Factors). Microsoft has not published technical detail on the underlying defect; the CWE pairing suggests validation logic that does not account for every factor it needs to, which would allow a check meant to gate access to be satisfied by input that should not pass it. That reading is inferred from the classification, not stated in the advisory.
The CVE was published on 2026-09-08 by Microsoft ([email protected]) and is currently listed as Undergoing Analysis in the NVD.
Why It Matters
The CVSS 3.1 base score is 9.6 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.
The combination driving that score is worth spelling out:
- Network attack vector, low complexity, no privileges required: nothing about the attack is gated behind credentials or difficult conditions.
- Scope: Changed: the impact extends beyond the vulnerable component itself, which is what pushes this above a 9.0.
- High confidentiality, integrity, and availability impact: the metrics describe total loss across all three, though without technical detail it is not public exactly what the bypassed protection was guarding.
The one mitigating factor is User Interaction: Required. An attacker cannot trigger this unassisted; a developer has to be induced to open or engage with something. Given VS Code's install base on developer workstations, machines that typically hold source code, cloud credentials, and CI/CD access, that bar is low in practice.
As of publication, CVE-2026-81376 does not appear in the CISA Known Exploited Vulnerabilities catalog (linked below), so there is no confirmed evidence of active exploitation at this time, and no federally mandated remediation deadline under BOD 22-01.
What's Vulnerable
The affected range as it currently appears in the CVE record:
| Vendor | Product | Affected Versions |
|---|---|---|
| Microsoft | Visual Studio Code | >= 1.0.0, < 1.136.2 |
Treat that upper bound with caution. Visual Studio Code ships on a roughly monthly cadence and its actual release numbering as of September 2026 is well below 1.136, so the version string in the record does not line up with the shipping product and may be a data-entry artifact pending NVD analysis. Verify the real fixed build against the MSRC update guide before using this range to scope remediation. The lower bound of 1.0.0 is a catch-all rather than evidence that every release since 1.0 is affected.
No CPE entries have been published yet. No public exploit code is referenced in the source material.
Patch Status
The CVE record identifies Visual Studio Code 1.136.2 as the fixed version, subject to the versioning caveat above. The practical guidance is to update Visual Studio Code to the current release and let auto-update run; check the MSRC update guide for the authoritative build number and distribution details rather than relying on the version string in the CVE record.
Sources
- NVD, CVE-2026-81376: https://nvd.nist.gov/vuln/detail/CVE-2026-81376
- Microsoft MSRC Update Guide; CVE-2026-81376: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81376
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog