What is the CVSS score of CVE-2026-69306?

CVE-2026-69306 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.4%.

Which versions of Visual Studio Code are affected by CVE-2026-69306?

Visual Studio Code is vulnerable to an unauthenticated security control bypass (CVE-2026-69306, CVSS 8.2) that could expose sensitive data across your development environment if users are socially…. A patch is available.

How to fix or mitigate CVE-2026-69306?

Begin immediate assessment within 24 hours to inventory all VS Code installations and identify development teams on affected versions. Note that no public exploit identified at time of analysis, providing a window for defensive preparation before public disclosure becomes imminent. Within 7 days, implement compensating controls including network segmentation for development systems, mandatory security awareness training on suspicious prompts, and EDR monitoring for anomalous VS Code behavior. Within 30 days, monitor Microsoft's security advisories continuously and establish direct vendor communication channels to track patch development; no vendor-released patch identified at time of analysis, but maintain readiness to deploy immediately upon release.

Visual Studio Code CVE-2026-69306

EUVD-2026-56563 HIGH

Not Failing Securely ('Failing Open') (CWE-636)

2026-08-11 secure@microsoft.com

GHSA-9ff9-572c-7rg8

Authentication Bypass Microsoft Visual Studio Code

8.2

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

ENISA EUVD

HIGH

qualitative

vuln.today AI

8.2 HIGH

Network delivery with no required privileges; user interaction triggers fail-open; scope change and high confidentiality reflect security boundary dissolution with no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Aug 11, 2026 - 18:19 EUVD

Analysis Generated

Aug 11, 2026 - 17:58 vuln.today

CVE Published

Aug 11, 2026 - 17:19 nvd

HIGH 8.2

DescriptionCVE.org

Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

AnalysisAI

Fail-open security logic in Visual Studio Code permits network-based security feature bypass by an unauthenticated attacker who can induce user interaction. The root cause is CWE-636: when the application encounters an error or edge condition in a security enforcement path, it defaults to granting rather than denying access, neutralizing the intended control. With a CVSS score of 8.2 and a scope-changed vector (S:C) paired with high confidentiality impact, successful exploitation could expose data or capabilities beyond the direct VS Code process boundary. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

CWE-636 ('Not Failing Securely') describes a class of vulnerability where error-handling logic in a security enforcement mechanism defaults to a permissive state rather than a safe-deny state. In Visual Studio Code - Microsoft's widely deployed Electron-based IDE - this manifests as a network-reachable security feature (likely in workspace trust, extension validation, remote development connections, or certificate checking) that, upon encountering a failure condition, allows the operation to proceed rather than blocking it. The CVSS scope change (S:C) indicates the vulnerability's impact escapes the VS Code process sandbox, affecting another security domain - consistent with a trust boundary being silently dissolved when the enforcement mechanism fails. The CPE data was not explicitly supplied, so the precise VS Code component and version range are inferred from the MSRC advisory reference.

RemediationAI

The primary remediation is to apply the patch released by Microsoft for Visual Studio Code, details of which are available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69306. VS Code supports auto-update by default; administrators should verify that auto-update is enabled and that the update has been applied across all developer endpoints. An exact fixed version number was not present in the supplied intelligence and should be confirmed from the MSRC advisory before communicating patch targets to teams. As a compensating control pending patching, administrators can restrict VS Code's network-facing features - specifically disabling Remote Development extensions, Live Share, and untrusted workspace connections - via VS Code's settings or organizational extension policy. Disabling these features limits VS Code's network attack surface but will impact developer productivity for teams using remote workloads. Workspace Trust prompts should be enforced rather than bypassed via user preference overrides.