EUVD-2026-56563
GHSA-9ff9-572c-7rg8
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Network delivery with no required privileges; user interaction triggers fail-open; scope change and high confidentiality reflect security boundary dissolution with no availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
AnalysisAI
Fail-open security logic in Visual Studio Code permits network-based security feature bypass by an unauthenticated attacker who can induce user interaction. The root cause is CWE-636: when the application encounters an error or edge condition in a security enforcement path, it defaults to granting rather than denying access, neutralizing the intended control. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to perform a user interaction - opening a malicious workspace, file, or accepting a remote connection - that triggers the fail-open condition in VS Code's security enforcement logic (UI:R per CVSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The 8.2 CVSS base score is substantiated by a network attack vector, low complexity, no required privileges, and high confidentiality impact - a combination that warrants serious attention. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious VS Code workspace, repository, or remote connection invitation and delivers it to a target developer via phishing or a compromised code-hosting link. When the developer opens the content in VS Code, the fail-open logic in a security enforcement path triggers on an error condition, silently granting access that should have been denied. … |
| Remediation | The primary remediation is to apply the patch released by Microsoft for Visual Studio Code, details of which are available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69306. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Begin immediate assessment within 24 hours to inventory all VS Code installations and identify development teams on affected versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Visual Studio Code
View allVisual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authent
Visual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely e
Privilege escalation in Microsoft Visual Studio Code allows remote unauthenticated attackers to elevate privileges over
Security-feature bypass in Microsoft Visual Studio Code lets a remote attacker deliver functionality from an untrusted c
Remote code execution in Visual Studio Code (versions 1.0.0 through 1.132.0) is enabled by a missing authorization check
Remote code execution in Microsoft Visual Studio Code allows a network-based attacker to inject and execute arbitrary co
OS command injection in Visual Studio Code exposes victims to remote code execution when they interact with attacker-con
Security-feature bypass in GitHub Copilot and Visual Studio (affecting Visual Studio Code builds before 1.119.1) lets a
Privilege elevation in Microsoft Visual Studio Code (all releases from 1.0.0 up to but not including 1.119.1) stems from
Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attac
Local code execution in Microsoft Visual Studio Code stems from a command injection flaw (CWE-77) that lets an attacker
Security feature bypass via path traversal in GitHub Copilot and Visual Studio Code allows a local unauthorized attacker
Same weakness CWE-636 – Not Failing Securely ('Failing Open')
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today