CVE-2026-70336: Visual Studio Code Remote Code Execution Vulnerability
CVE-2026-70336 is a remote code execution vulnerability in Visual Studio Code, rated Important by Microsoft, with a CVSS 3.1 base score of 8.8 (High). An attacker can exploit it remotely over the network, without any privileges and only if a user takes an action. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 0.82% probability of exploitation activity in the next 30 days, higher than 57% of all scored vulnerabilities. Microsoft released the fix on 11 August 2026 in the August 2026 Patch Tuesday. It affects 1 product in 1 product family (Developer Tools).
Key facts
- CVE ID
- CVE-2026-70336
- Severity
- High CVSS 8.8
- Microsoft severity
- Important
- Impact
- Remote Code Execution
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- Less Likely
- Weakness
- CWE-94
- EPSS
- 0.82% (percentile 57%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- August 2026 Patch Tuesday
- Product families
- Developer Tools
CVSS score and vector
Microsoft scores CVE-2026-70336 at 8.8 (temporal 7.7) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality impact | High |
| Integrity impact | High |
| Availability impact | High |
| Exploit code maturity | Unproven |
| Remediation level | Official fix |
| Report confidence | Confirmed |
Description
Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
Frequently asked questions (Microsoft)
How could an attacker exploit this vulnerability?
An attacker could craft a malicious link or web page and use social engineering to convince a user to open it in Visual Studio Code. Successful exploitation could result in code execution in the user's connected development environment. User interaction is required to open the attacker-supplied link, and no authentication is needed.
Affected products (1)
Developer Tools
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Visual Studio Code | Release Notes | Security Update | 1.132.1 | No |
NIST NVD data
- NVD status
- Analyzed
- NVD CVSS
- 8.8 (HIGH)
- NVD weakness
- CWE-94
- Published to NVD
- NVD last modified
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| visual studio code | before 1.132.1 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70336 (Vendor Advisory, Release Notes)
Acknowledgments
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. | |
| 1.1 | Affected software updated with new package information. |