Microsoft November 2026 Patch Tuesday fixes 1093 CVEs, one exploited
Outlook spoofing CVE-2026-124194, used as a zero-day, leaks NTLMv2 hashes when a crafted Office file is opened.
78
CVE-2026-121662
Local command injection in Visual Studio Code
- CVSS 3.1
- 8.6 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Visual Studio Code fails to neutralize special elements in a command, allowing command injection. An unauthorized attacker who already has local access can trigger it if the user interacts with the vulnerable component, and can then execute code. Microsoft has not listed affected builds. Users of Visual Studio Code are affected.
What to do: Apply Microsoft's update for CVE-2026-121662. Microsoft has not listed a fixed version or a workaround.
| Product | Affected |
|---|---|
| Microsoft Visual Studio Code | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code locally.
- Weakness
- CWE-77
- Vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H