CVE-2026-59113: Visual Studio Code Remote Code Execution Vulnerability
CVE-2026-59113 is a remote code execution vulnerability in Visual Studio Code, rated Important by Microsoft, with a CVSS 3.1 base score of 8.8 (High). An attacker can exploit it remotely over the network, without any privileges and only if a user takes an action. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 0.76% probability of exploitation activity in the next 30 days, higher than 56% of all scored vulnerabilities. Microsoft released the fix on 11 August 2026 in the August 2026 Patch Tuesday. It affects 1 product in 1 product family (Developer Tools).
Key facts
- CVE ID
- CVE-2026-59113
- Severity
- High CVSS 8.8
- Microsoft severity
- Important
- Impact
- Remote Code Execution
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- Less Likely
- Weakness
- CWE-862
- EPSS
- 0.76% (percentile 56%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- August 2026 Patch Tuesday
- Product families
- Developer Tools
CVSS score and vector
Microsoft scores CVE-2026-59113 at 8.8 (temporal 7.7) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality impact | High |
| Integrity impact | High |
| Availability impact | High |
| Exploit code maturity | Unproven |
| Remediation level | Official fix |
| Report confidence | Confirmed |
Description
Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
Frequently asked questions (Microsoft)
How could an attacker exploit this vulnerability?
An attacker could host a specially crafted web page and use social engineering to convince a user to have the application retrieve it. The malicious page could then cause the application to launch operating-system protocol handlers without prompting the user, which could result in code execution on the user's system. User interaction is required.
Affected products (1)
Developer Tools
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Visual Studio Code | Release Notes | Security Update | 1.132.1 | No |
NIST NVD data
- NVD status
- Analyzed
- NVD CVSS
- 8.8 (HIGH)
- NVD weakness
- CWE-862
- Published to NVD
- NVD last modified
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| visual studio code | before 1.132.1 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-59113 (Vendor Advisory, Release Notes)
Acknowledgments
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. | |
| 1.1 | Affected software updated with new package information. | |
| 1.2 | Updated the fixed version information and download link. The fix was previously believed to be included in Dynamics 365 Server (on-premises) version 6.2; however, it has been confirmed that the fix is included in Dynamics 365 Server v9.1 (on-premises) Update 1.45 (version 9.1.0045.0011). The download link, release notes, and build number has been updated accordingly in the Security Updates table. This is an informational change only. |