What is the CVSS score of CVE-2026-41613?

CVE-2026-41613 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Visual Studio Code are affected by CVE-2026-41613?

Microsoft Visual Studio Code (versions before 1.119.1) contains a session hijacking vulnerability that exposes development teams to unauthorized access and potential malicious code injection into…. A patch is available.

How to fix or mitigate CVE-2026-41613?

Within 24 hours, inventory all Visual Studio Code installations in your organization and identify systems running versions earlier than 1.119.1; communicate patch requirements to development teams. Within 7 days, deploy Visual Studio Code version 1.119.1 or later enterprise-wide through your standard software distribution channels to achieve complete coverage. Within 30 days, verify 100% patch adoption across all developer devices, review system logs for suspicious authentication activity during the vulnerability window, and confirm no unauthorized repository modifications occurred.

Visual Studio Code CVE-2026-41613

EUVD-2026-29696 HIGH

Session Fixation (CWE-384)

2026-05-12 microsoft

Session Fixation Authentication Bypass Visual Studio Code

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

vuln.today AI

7.5 HIGH

Network unauthenticated with victim interaction, but session fixation requires the attacker to first plant a token and time the victim's login, so AC:H; session compromise yields full C/I/A.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 21:04 vuln.today

CVE Published

May 12, 2026 - 16:59 nvd

HIGH 8.8

DescriptionCVE.org

Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.

AnalysisAI

Privilege elevation in Microsoft Visual Studio Code (all releases from 1.0.0 up to but not including 1.119.1) stems from a session fixation weakness (CWE-384) that a remote, unauthenticated attacker can leverage to hijack a victim's authenticated session after the victim is lured into interacting with an attacker-supplied session identifier. The flaw carries a CVSS 8.8 rating with total confidentiality, integrity, and availability impact, but currently has no public exploit identified at time of analysis and a low EPSS score of 0.06% (18th percentile). Microsoft self-reported the issue and has shipped a fix, while CISA's SSVC framework records exploitation as 'none' and non-automatable.

Technical ContextAI

Visual Studio Code is Microsoft's cross-platform Electron-based source-code editor, identified here by cpe:2.3:a:microsoft:visual_studio_code. The root cause is CWE-384 (Session Fixation), a class of flaw where the application accepts and reuses a session identifier that was established before authentication rather than issuing a fresh identifier upon successful login. When a session token supplied or influenced by an attacker survives the authentication transition, the attacker who knows that token inherits the victim's authenticated context. In VS Code this manifests over a network-reachable session-handling path (consistent with features such as remote/tunnel or web-based sessions), where the fixated identifier lets an attacker assume the privileges of the authenticating user. The tags 'Authentication Bypass' and 'Session Fixation' reinforce that the security boundary being crossed is session-level authentication.

RemediationAI

Vendor-released patch: upgrade Visual Studio Code to 1.119.1 or later, which is the first release outside the affected 1.0.0-<1.119.1 range per the EUVD data; consult the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41613 for the definitive fixed build. Because exploitation requires user interaction and network reachability of the session path, interim compensating controls include disabling or restricting network-facing session features such as Remote Tunnels/Remote-SSH or the browser/web-served editor if not required (trade-off: loss of remote-development convenience), and instructing users not to open or reuse VS Code session/tunnel links received from untrusted sources (trade-off: relies on user vigilance and does not fully close the gap). Since Microsoft has shipped a fixed version, patching is the primary and preferred remediation and should be prioritized over workarounds; verify the auto-update channel is enabled so endpoints receive 1.119.1.