What is the CVSS score of CVE-2026-21523?

CVE-2026-21523 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-21523?

Within 24 hours: Inventory all GitHub Copilot and Visual Studio installations across the organization and disable the affected Copilot feature pending patch availability. Within 7 days: Communicate vulnerability details to all developers, establish code review protocols for Copilot-generated code, and monitor for suspicious activity. Within 30 days: Implement network monitoring and access controls for development environments; re-enable Copilot only after vendor releases and validates patches.

Github CVE-2026-21523

HIGH

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2026-02-10 secure@microsoft.com

Github Race Condition Microsoft AI / ML Visual Studio Code

8.0

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate to GitHub Copilot/VS Code
Exploit

Trigger code suggestion generation
Execution

Manipulate file system during check-use window
Impact

Execute arbitrary code via race condition

Vulnerability Assessment

Weakness	CWE CWE-367 OWASP Top 10:2025 A04:2021 - Insecure Design ASVS 5.0 V15 - Secure Coding and Architecture TOCTOU prevention
Exploitation Conditions	Requires authenticated user account (PR:L). User interaction needed (UI:R) to trigger code suggestion feature. Vulnerable when Copilot performs file validation followed by execution without atomic locks protecting TOCTOU window in GitHub Copilot or Visual Studio environments.
Impact	CVSS 8.0 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: Low. User interaction: Required. Exploitable via remote/network.
Exploit ScenarioDerived	A remote attacker could exploit this vulnerability to compromise the affected system.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Authenticated users can exploit a race condition in GitHub Copilot and Visual Studio Code to execute arbitrary code remotely by manipulating file state between verification and use. This vulnerability affects users with network access to these development tools and requires user interaction to trigger. No patch is currently available to address this high-severity flaw.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 22:02 CVSS 8.0

Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network. [CVSS 8.0 HIGH]

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

Affected Packages

microsoft visual_studio_code_1_110_1 fix: Visual Studio Code 1.110.1

microsoft visual_studio_code_copilot_chat_extension_0_37_1 fix: Microsoft Visual Studio Code CoPilot Chat Extension 0.37.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in microsoft

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Affects Visual Studio Code. Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network.

Know when Github gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 8.0 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network.

Executive ViewAI

Why It Matters

A high-severity race condition vulnerability in GitHub Copilot and Visual Studio allows authenticated attackers to execute arbitrary code on developer machines and systems. This directly impacts software development teams and poses a supply chain risk, as compromised code could be introduced into organizational applications.

Business Impact: High

Compensating Controls

Disable GitHub Copilot feature in Visual Studio until patch becomes available; implement mandatory peer code review for all Copilot-assisted code; restrict Copilot access to isolated development networks without sensitive data; monitor developer machine activity for unauthorized code execution; require multi-factor authentication for Copilot and development tool access; consider temporary ban on Copilot use for sensitive projects until patched.

Threat Intelligence Overview

EPSS Score

0.0%

Top 93% exploitable

Data Quality

3 sources

Confidence: Low

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +40

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Race Condition MEDIUM

Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).