CVE-2026-119985: Visual Studio Code Remote Code Execution Vulnerability

Q: What level of access does an attacker need to exploit this issue?

The attacker does not need prior privileges, but exploitation requires network reachability and user interaction. The attack complexity is rated high.

Q: What impact could successful exploitation have?

Successful exploitation could allow code execution and affect confidentiality, integrity, and availability at a high level. The scope is changed, indicating impacts may extend beyond the initially vulnerable security authority.

Q: Is exploitation known to be occurring?

The exploit maturity is rated unknown. The provided data does not confirm active exploitation.

Published Nov 10, 2026

Updated

Incorrect authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.

Other sources

Visual Studio Code Remote Code Execution Vulnerability

— Microsoft

Affected Software

1 affected componentFixes available

Microsoft Visual Studio Code<1.145.3

1.145.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.145.3

Event History

Nov 10, 2026

CVE Published

via Microsoft·04:00 PM

Data Sourced

via Microsoft·04:00 PM

DescriptionSeverityWeakness

Data Sourced

via Microsoft·04:00 PM

Affected Software

CVE Published

via MITRE·06:21 PM

Data Sourced

via MITRE·06:21 PM

DescriptionSeverity

Data Sourced

via NVD·07:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The attacker does not need prior privileges, but exploitation requires network reachability and user interaction. The attack complexity is rated high.

What impact could successful exploitation have?

Successful exploitation could allow code execution and affect confidentiality, integrity, and availability at a high level. The scope is changed, indicating impacts may extend beyond the initially vulnerable security authority.

Is exploitation known to be occurring?

The exploit maturity is rated unknown. The provided data does not confirm active exploitation.

CVE-2026-119985: Visual Studio Code Remote Code Execution Vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What impact could successful exploitation have?

Is exploitation known to be occurring?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What impact could successful exploitation have?

Is exploitation known to be occurring?