Advisory · CVE-2026-119985
Remote code execution in Visual Studio Code
Incorrect authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network. Microsoft rates it High at CVSS 8.3.
- Vendor
- Microsoft
- Product
- Visual Studio Code
- Identifier / CWE
- CVE-2026-119985
CWE-863 - Action timing
- Immediate
Explain it like I’m five
The bouncer checks a badge but misses a side door. An attacker who already has a low-level badge can walk through the side door into the part of Visual Studio Code that was supposed to be off limits.
- 01Attacker prepares the lure
An attacker prepares crafted content or a link that exercises the flaw in Visual Studio Code.
- 02Victim interacts
A user interacts with the crafted content, for example by opening it or following a link.
- 03Flaw triggers
The component mishandles the interaction and the flaw takes effect.
- 04Impact lands
The attacker gains the code execution, elevation, or access the flaw allows.
What happened
Microsoft disclosed CVE-2026-119985 in its November 2026 security update guide: Incorrect authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network. Microsoft rates it CVSS 8.3 (high, CWE-863). Microsoft lists builds before 1.145.3 as affected.
Exploitation is reachable over the network; no privileges required; user interaction required; high attack complexity. The scope can change, so a successful exploit can affect resources beyond the vulnerable component. Until the update is applied, the exposure is controlled by who holds an account or access to the affected component.
What to do
- Inventory every Visual Studio Code deployment, including test, training, and individually managed instances.
- Update Visual Studio Code to 1.145.3 or later.
- Restrict access to Visual Studio Code while remediation is underway, especially for internet-facing instances.
- Review application and server logs for signs of exploitation around the flaw.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
A remotely reachable code-execution flaw in Visual Studio Code is a patch-now item: the fix is available, the exposure is network-shaped, and every unpatched instance is a foothold waiting to be taken.