CVE-2026-69278

Visual Studio Code Security Feature Bypass Vulnerability

No known exploitation. EPSS puts it in the 24th percentile. Fixed in 1.132.1.

CVSS 3.17.8High EPSS percentile24th0.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix1.132.1Upgrade to this build

Published 2026-08-11Updated 2026-09-25Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Microsoft Visual Studio CodeAffected: ≥ 1.0.0, < 1.132.1Upgrade to: 1.132.1Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check your installed Visual Studio Code version and see whether it is older than 1.132.1.
If you are on an affected version, update Visual Studio Code to 1.132.1.
If you cannot update immediately, avoid opening/successfully triggering untrusted prompts or files that request actions inside Visual Studio Code, and remove/limit local access for unknown users.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

In plain language

Written by AI from the record

CVE-2026-69278 is a Visual Studio Code flaw where a local attacker can trick you into an action that bypasses a built-in security protection, potentially leading to full takeover of your computer—so you should update to the fixed version as soon as possible.

CVE-2026-69278 is a local security feature bypass in Visual Studio Code (CWE-693/CWE-863): an attacker can bypass authorization by leveraging incorrect security control logic after user interaction, potentially resulting in full system compromise; fixed in Visual Studio Code 1.132.1.

If you're affected

Total computer takeover
Malware installation risk
Business data theft risk
Operations disruption

What is it

Think of Visual Studio Code’s security protections as a locked gate that should stop dangerous actions. This bug is like finding a way to get past the lock—if someone nearby (locally) can get you to click or run something—so the attacker may then gain full control of your computer.

Who is affected

This matters if you use or run Visual Studio Code on a machine where someone else can interact locally (for example, another person with local access) and can get you to take an action in the app. Because the attack requires user interaction, the main risk is being tricked into clicking/approving something while VS Code is running. Reachability in the default configuration is not confirmed here, but the attack requires local access and user interaction.

How urgent is it

This is RED because the attacker goal is severe (bypassing security controls to reach full system control) and it only needs local access plus user interaction, which is a common real-world path via social engineering. Microsoft has a specific fix available (1.132.1), so you should treat it as an urgent update for any business machines running Visual Studio Code.

What to do — in detail

Confirm the installed version: In Visual Studio Code, open the version info (typically via “Help” → “About”), and record the exact version number.
Determine if you’re affected: If your version is older than 1.132.1, you should treat you as potentially affected.
Upgrade to the fixed version: Update Visual Studio Code to 1.132.1 as directed by Microsoft’s update guide for CVE-2026-69278.
Validate after updating: Re-check the Visual Studio Code “About” screen to confirm the version is now 1.132.1.
If patching is delayed (temporary containment):
- Be strict about what you open or run in VS Code when prompted by files, extensions, or messages from unknown sources.
- Limit who can get local access to your workstation (reduce shared/local accounts, enforce strong OS login controls).
- Remove unnecessary permissions for users who don’t need them.
What to monitor: After updating, monitor for unexpected behavior related to Visual Studio Code (unexpected downloads, new processes spawned by the app, or unusual extension activity). If your organization has endpoint logging, look for any Visual Studio Code–spawned process chains around the times users click on suspicious prompts.

Technical context

CVE-2026-69278 is a Visual Studio Code local security feature bypass involving incorrect authorization logic (CWE-693) and an authorization/bypass class issue (CWE-863). The described mechanism is that an attacker with local access can trick a user into performing an action in Visual Studio Code that bypasses a security protection, which can lead to full compromise (high business severity). No public exploit code was found in the provided records. KEV does not list this CVE. The provided press materials do not describe CVE-2026-69278 being exploited in the wild; they mention confirmed exploitation for a different CVE (CVE-2026-68820) and do not attribute active exploitation to this specific bug. A prediction (EPSS) exists but is not used to justify public urgency here; the fix is available in Visual Studio Code 1.132.1. (Traffic-light verdict: RED.)

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS24th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.3% chance of exploitation activity in the next 30 days, which ranks it in the 24th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

15 events over 45 days, from the signal feeds we watch.

2026-09-25Patch availablerecord updated
2026-09-02Patch availablerecord updated
2026-08-28Patch availablerecord updated
2026-08-21OpenVAS check added
2026-08-14Patch availablerecord updated
2026-08-12Record updatedrecord updated

Affected products

Microsoftcommercial · US
- Visual Studio CodeDesktop AppOn-premConsumer Software

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable