Cyber Resilience

CVE-2026-41613

HighRCE

Published: 12 May 2026

Published
12 May 2026
Modified
15 May 2026
KEV Added
Patch
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0052 40.3th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-41613 is a high-severity OS Command Injection (CWE-78) vulnerability in Microsoft Visual Studio Code. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 40.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Session fixation (CWE-384) with network access enables remote privilege escalation (T1068) via exploitation of a public-facing VS Code component (T1190).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-24042Same product: Microsoft Visual Studio Code
CVE-2026-41611Same product: Microsoft Visual Studio Code
CVE-2025-24039Same product: Microsoft Visual Studio Code
CVE-2025-26631Same product: Microsoft Visual Studio Code
CVE-2026-41109Same product: Microsoft Visual Studio Code
CVE-2026-21523Same product: Microsoft Visual Studio Code
CVE-2026-21518Same product: Microsoft Visual Studio Code
CVE-2025-26683Same vendor: Microsoft
CVE-2026-32191Same vendor: Microsoft
CVE-2025-21177Same vendor: Microsoft

Affected Assets

microsoft
visual studio code
≤ 1.119.1

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-384

Session termination after a set interval shortens the usable lifetime of a fixed session identifier, making successful exploitation of session fixation more difficult.

addresses: CWE-384

Re-authentication typically forces issuance of a new session, limiting the window for exploitation of a previously fixed session identifier.

addresses: CWE-384

Enforces proper session ID generation and binding, preventing fixation of a known session token.

addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References