Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-81376 |
| Alert source | GitHub Advisory - critical vulnerability |
| CVE year | 2026 |
| Publication date | 2026-09-08 |
| Vendor | Microsoft |
| Product | Visual Studio Code |
| Vulnerability class | incomplete comparison with missing factors |
| Impact | security feature bypass over a network |
| CVSS Score | 9.6 (Critical) |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
Visual Studio Code contains an incomplete comparison with missing factors. The bug allows an unauthenticated attacker to bypass a security feature over the network. The vulnerability scores 9.6 on CVSS.
What this class of bug involves. Code checks the identity or validity of something — a source, a signature, an address, a permission — but checks too little: comparing one field instead of all the relevant ones, or using partial matching where an exact match was required. The effect is always similar: a value crafted by the attacker passes a check meant to stop it. This is the same family of bug that, in another product from the same week (Kestra), allowed authentication to be skipped entirely by matching the end of a path rather than the full address.
Why this matters even though it is “only” an editor. Not because of the editor, but because of what the machine running it can reach. A typical developer workstation holds:
- SSH keys and access tokens for code repositories,
- credentials for package registries and container image registries,
- access configurations for test environments, and very often production ones too,
- secrets loaded into environment variables during work.
Compromising such a workstation does not end with one computer — it is an entry point into the software build and release process. This is why development workstations are targets whose value is out of proportion to their number in an organisation: there are a dozen or so of them, and they lead everywhere.
The vulnerability is not currently in the CISA KEV catalog and there are no public reports of exploitation.
Required Actions
- Update Visual Studio Code to the latest version on all development workstations.
- Check installations with auto-update disabled. VS Code updates itself by default, but in many organisations that mechanism is disabled by policy, or the editor is deployed in portable form. Those installations will not receive the fix on their own, and they are the ones that most often fall behind.
- Inventory where else VS Code runs. Beyond developer laptops it is often installed on jump servers, in development containers, and on virtual machines used for administration. Those instances rarely make it into the workstation inventory.
- Review installed extensions while you are at it. This vulnerability does not concern them, but extensions run with the editor’s privileges and can read open code. Removing the ones nobody uses any more reduces the attack surface regardless of this flaw.
- Verify where the development team’s secrets live. If keys and tokens are stored in configuration files inside the project directory, compromising the editor means exposing them. Moving them into a secrets manager is a broader change than responding to a single alert — but alerts like this are what show why it is worth doing.
Who Is Affected?
The vulnerability affects Visual Studio Code — the editor used today by most development teams, regardless of language or technology stack.
Directly exposed are organisations running an in-house development team. The numbers involved are usually small — a dozen or a few dozen workstations — but the weight of a single machine is far higher here than for an office desktop.
It is also worth remembering the machines outside the development team. Visual Studio Code is often used by administrators to edit configuration, by analysts working with data, and by operations teams reviewing logs. Those installations are typically outside the update process designed for developer tooling, because formally they do not fall into that category.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is CVE-2026-81376?
It is an incomplete comparison with missing factors in Visual Studio Code. It allows an unauthenticated attacker to bypass a security feature over a network. CVSS score: 9.6.
What does 'incomplete comparison' mean?
It is a class of bug where code checks the identity or validity of something but checks too little - comparing one field instead of all the relevant ones, or using partial matching where an exact match was required. The result is that a value crafted by the attacker passes a check that was meant to reject it.
Why is a code editor flaw taken seriously?
Not because of the editor itself, but because of what the machine it runs on can reach. A developer workstation typically holds SSH keys for code repositories, access tokens for package registries, credentials for test environments and often production ones too. That makes it a target whose value is out of proportion to the number of such machines in the organisation.
Are VS Code extensions also at risk?
This particular vulnerability concerns Visual Studio Code itself, not extensions. It is nonetheless a good moment to review installed extensions - they run with the editor's privileges and have access to open code and project files, and their vetting is often far weaker than that of the editor itself.
How do I protect my organisation?
Update Visual Studio Code to the latest version on all development workstations. VS Code usually updates automatically, but in organisations where auto-update is disabled by policy, or where a portable installation is used, this has to be done deliberately - and those installations are precisely the ones that fall behind.
