CVE-2026-81379

Analyzed Analyzed - Analysis Complete

Failing Open Security Bypass in Visual Studio Code

Publication date: 2026-09-08

Last updated on: 2026-09-11

Assigner: Microsoft Corporation

Description

Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-11

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-81379

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	visual_studio_code	to 1.136.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-636	When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.

Attack-Flow Graph

Executive Summary

This vulnerability involves Visual Studio Code failing to enforce security properly, allowing an unauthorized attacker to bypass a security feature over a network. This is known as failing open, where the system does not default to a secure state when an error occurs.

Impact Analysis

An attacker could exploit this to bypass security controls in Visual Studio Code, potentially gaining unauthorized access to sensitive data or executing malicious actions. The high CVSS score indicates significant risk of confidentiality and integrity compromise.

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure, violating GDPR's data protection principles and HIPAA's security requirements. Organizations using Visual Studio Code may fail compliance audits if this issue is not addressed.

Mitigation Strategies

Update Visual Studio Code to the latest version to ensure the failing securely mechanism is patched. Monitor network traffic for unusual bypass attempts and restrict unauthorized access to the application.

Hi! I’m here to help you understand CVE-2026-81379. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70