{"id":"CVE-2026-120780","kind":"vulnerability","aliases":["CVE-2026-120780"],"related":[],"title":"Visual Studio Code: access control flaw lets remote attacker run code","description":"Improper access control in Visual Studio Code allows an unauthorized attacker to execute code over a network.","summary":"Visual Studio Code has an improper access control flaw that lets an unauthorized attacker execute code over a network. The sources give no product versions, preconditions or user actions.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","visual-studio-code"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:20:27+00:00","first_seen_at":"2026-11-10T19:25:07+00:00","triaged_at":"2026-11-10T19:34:27+00:00","updated_at":"2026-11-10T19:34:27+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-10T19:34:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Visual Studio Code: access control flaw lets remote attacker run code","impact":"high","summary":"Visual Studio Code has an improper access control flaw that lets an unauthorized attacker execute code over a network. The sources give no product versions, preconditions or user actions.","audience":"developers","category":"other","nicknames":[],"who_cares":["visual-studio-code"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs code on the developer's machine over the network","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-120780 and Microsoft's advisory for affected versions, fixed builds and preconditions.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000628,"input_tokens":4480,"output_tokens":359,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-120780 and Microsoft's advisory for affected versions, fixed builds and preconditions.","search":"'-120780':14A,17A '-2026':13A,16A 'access':4A,29B,53C 'action':51B 'allow':59C 'attack':9A,36B,62C 'code':3A,11A,22B,25B,38B,58C,65C 'control':5A,30B,54C 'cve':12A,15A 'execut':37B,64C 'flaw':6A,31B 'give':44B 'improp':28B,52C 'let':7A,33B 'network':41B,68C 'precondit':48B 'product':46B 'remot':8A 'run':10A 'sourc':43B 'studio':2A,21B,24B,57C 'unauthor':35B,61C 'user':50B 'version':47B 'visual':1A,20B,23B,56C 'visual-studio-cod':19B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","other","visualstudiocode"],"campaign_type":null,"search_a":"'-120780':14A,17A '-2026':13A,16A 'access':4A 'attack':9A 'code':3A,11A 'control':5A 'cve':12A,15A 'flaw':6A 'let':7A 'remot':8A 'run':10A 'studio':2A 'visual':1A","search_b":"'access':29B 'action':51B 'attack':36B 'code':22B,25B,38B 'control':30B 'execut':37B 'flaw':31B 'give':44B 'improp':28B 'let':33B 'network':41B 'precondit':48B 'product':46B 'sourc':43B 'studio':21B,24B 'unauthor':35B 'user':50B 'version':47B 'visual':20B,23B 'visual-studio-cod':19B","search_c":"'access':53C 'allow':59C 'attack':62C 'code':58C,65C 'control':54C 'execut':64C 'improp':52C 'network':68C 'studio':57C 'unauthor':61C 'visual':56C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120780","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120780","severity":null,"published_at":"2026-11-10T19:20:27+00:00","modified_at":"2026-11-10T19:20:27+00:00","first_seen_at":"2026-11-10T19:25:07+00:00","fetched_at":"2026-11-10T19:25:07+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}