CVE-2026

Api.Msrc.Microsoft • September 8, 2026

We use optional cookies to improve your experience on our websites, such as through social media connections, and to display personalized advertising based on your online activity. If you reject optional cookies, only cookies necessary to provide you the services will be used. You may change your selection by clicking “Manage Cookies” at the bottom of the page. Privacy Statement Third-Party Cookies

Released: Sep 8, 2026

CWE-1023: Incomplete Comparison with Missing Factors

CWE-693: Protection Mechanism Failure

Please see Common Vulnerability Scoring System for more information on the definition of these metrics.

Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

The following table provides an exploitability assessment for this vulnerability at the time of original publication.

How could an attacker exploit this vulnerability?

An attacker could convince a user to open a specially crafted Visual Studio Code workspace. The workspace could cause Visual Studio Code to connect to an attacker-controlled service and bypass Workspace Trust restrictions. Successful exploitation could allow the attacker to access local data or execute code in the context of the user. User interaction is required, but the user does not need to trust the workspace.

What security feature could be bypassed by successfully exploiting this vulnerability?

An attacker who successfully exploited this vulnerability could bypass the Visual Studio Code Workspace Trust feature, allowing content from an untrusted workspace to run commands or code without the user first granting trust. See Workspace Trust for more information.

According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?

In this case, a successful attack can break out of the Visual Studio Code Workspace Trust feature. See Workspace Trust for more information.

Oran with Palo Alto Networks

Thomas Neil James Shadwell (zemnmez) with OpenAI

Jebeen Lee

陳宥升 (CheN..)

To determine the support lifecycle for your software, see the Microsoft Support Lifecycle .

Information published.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Disclosed on September 8, 2026, Affecting Microsoft Products On September 8, 2026, multiple CVEs were disclosed affecting various Microsoft products, including SharePoint and Office. Key vulnerabilities include improper access controls, buffer overflows, and command injections, which could allow unauthorized code execution and information disclosure. CVE-2026-85880, noted for active exploitation, was added to CISA's KEV list on the same day. Other vulnerabilities, such as CVE-2026-69428 and CVE-2026-69621, also pose significant risks due to their potential for exploitation. Organizations using affected versions of Microsoft products are urged to apply patches immediately to mitigate risks. The vulnerabilities impact a range of systems, including SharePoint Server and Microsoft Office, and could lead to severe consequences if exploited. 927 sources 74

CVE-2026

The full story

Extracted Entities

MITRE ATT&CK (1)

Platforms (1)