Vulnerabilities / CVE-2026-120779
Critical · not yet confirmed exploited · Microsoft Visual Studio CodeCVE-2026-120779
Microsoft Visual Studio Code critical critical vulnerability, CVSS 9.6.
Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
| Vendor and product | Microsoft · Visual Studio Code |
|---|---|
| Type | critical vulnerability |
| Severity | Critical 9.6 CVSS base score |
| Affected versions | Visual Studio Code: 1.0.0 to before 1.145.3 |
| First published | 10 November 2026 |
| Weakness | CWE-94: Improper Control of Generation of Code ('Code Injection') |
| Exploited | Not confirmed. Critical flaws in Microsoft products have been exploited before: Microsoft appears on CISA's exploited list. |
| Advisories | msrc.microsoft.com ↗ |
Patch before it is exploited
Apply the vendor's fix or mitigation; CISA lists only vulnerabilities seen exploited.
If you cannot patch now, restrict network access to the affected product.
Check for signs of compromise since the date it was added to the list.
Know the day it starts being used
Threat Landscape Monitoring fingerprints the software your internet-facing hosts disclose and tells you the day a vulnerability on them is confirmed exploited, with the host and the fix. The free plan covers one domain.
CVE-2026-120779 in short
Is CVE-2026-120779 being exploited?
Not confirmed as of 14 November 2026: CISA has not added it to its Known Exploited Vulnerabilities catalogue. Critical flaws in Microsoft products are a frequent target, so patch before that changes; this page is updated daily.
How severe is CVE-2026-120779?
NVD rates it critical, with a CVSS base score of 9.6.
Which versions of Microsoft Visual Studio Code are affected by CVE-2026-120779?
According to the CVE record: Visual Studio Code: 1.0.0 to before 1.145.3. Check the vendor's advisory for the fixed version.
How do I fix CVE-2026-120779?
Apply the vendor's fix or mitigation; CISA lists only vulnerabilities seen exploited. If you cannot patch now, restrict network access to the affected product. Check for signs of compromise since the date it was added to the list.
Sources: NVD, the CVE record, FIRST EPSS and the CISA Known Exploited Vulnerabilities catalogue. Page compiled automatically by SAK T.L.M, the threat-intelligence tool of SAK T.E.C, on 14 November 2026.