CVE-2026-47292

Visual Studio Code MSSQL Extension Remote Code Execution Vulnerability

No known exploitation. EPSS puts it in the 37th percentile. A vendor fix is available.

CVSS 3.17.8High EPSS percentile37th0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-06-09Updated 2026-08-24Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check your installed Visual Studio Code version and the Visual Studio Code - MSSQL Extension version currently installed.
Update Visual Studio Code - MSSQL Extension to version 1.123.2 or later.
Update Visual Studio Code to version 1.123.1 or later.
After updating, restart Visual Studio Code and confirm the MSSQL Extension version shows the updated number.
Avoid opening VS Code content (extensions/tools, imported projects, or prompts) from untrusted sources until updates are applied.

Vendor advisory Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to elevate privileges locally.

In plain language

Written by AI from the record

A security flaw in the Visual Studio Code MSSQL Extension could let an attacker run harmful code on a computer running VS Code if the attacker can get you to interact with something—this is a serious issue (RED), so you should update.

CVE-2026-47292 is a local remote code execution risk in the Visual Studio Code MSSQL Extension caused by inclusion of untrusted functionality, enabling an attacker to execute arbitrary code on the local system without needing authentication but requiring user interaction.

If you're affected

Malicious code execution on your PC
Loss of control of workstations
Ransomware/account takeover risk
Operational disruption from downtime

What is it

Think of the MSSQL Extension as a add-on tool inside VS Code. This vulnerability is like letting an untrusted component “plug in” in a way that can run arbitrary commands on your computer. If an attacker can trigger it, they could take control of your workstation and potentially pivot into other systems.

Who is affected

This matters if you use Visual Studio Code and specifically install the “Visual Studio Code - MSSQL Extension” add-on. It’s a local issue without needing authentication, but it requires user interaction, so it depends on an attacker being able to get a user to do something (for example, respond to a prompt or open a crafted item). It’s not yet known from the provided findings whether it’s reachable in the default configuration, so your best indicator is whether the affected extension is installed and what version you’re running.

How urgent is it

Verdict: RED. Even though there’s no public exploit code recorded and it’s not on the CISA KEV list, the vulnerability’s design allows arbitrary code execution on a local system without authentication and requires only user interaction—meaning attackers can focus on tricking users. You should update the affected VS Code and extension versions immediately.

What to do — in detail

Confirm exposure (fast)

On each workstation/server where you run VS Code, open Visual Studio Code.
Check the installed Visual Studio Code - MSSQL Extension version (Extensions view) and the Visual Studio Code application version.
Determine whether either is older than the fixed versions listed below.

Remediate to the fixed versions

Upgrade Visual Studio Code - MSSQL Extension to 1.123.2 or newer.
Upgrade visual studio code to 1.123.1 or newer.

Validation after patching

Restart Visual Studio Code.
Re-check that the MSSQL Extension reports the updated version.
If you manage machines with an update tool/policy, confirm the update actually landed and wasn’t blocked by policy or offline mode.

If you cannot patch immediately

Disable or remove the Visual Studio Code - MSSQL Extension temporarily until you can update both the extension and VS Code.
Reduce exposure by not opening untrusted projects/files or interacting with prompts related to MSSQL work in VS Code until patched.

What to monitor

Look for unusual behavior on developer/administrative workstations (unexpected processes spawned by VS Code workflows).
Review endpoint logs for suspicious executions from the user’s account shortly after VS Code activity.

KEV timeline

CVE-2026-47292 is not listed in CISA KEV in the provided findings, so no CISA due date is available from the supplied data.

Technical context

CVE-2026-47292 is classified as a Visual Studio Code MSSQL Extension Remote Code Execution vulnerability with weakness mappings to CWE-94 (Code Injection) and CWE-829 (Inclusion of Functionality from Untrusted Control Sphere). The core issue, per the findings, is that the extension enables arbitrary code execution due to the inclusion of untrusted functionality.

From the findings:

Attack type: local execution pathway.
Authentication required: no.
User interaction: required.
Exploitation status: no public exploit code is on record, and it is not listed in CISA KEV.
Reported likelihood: a prediction (EPSS-style) of 0.4% with a flat trend exists in the findings, but public exploitation confirmation was not provided.

Fixed versions (from patch findings):

Visual Studio Code - MSSQL Extension fixed in 1.123.2
visual studio code fixed in 1.123.1

This is treated as urgent (RED) because the mechanism supports arbitrary code execution on a local system once the required user interaction path is reached.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS37th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 37th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

9 events over 76 days, from the signal feeds we watch.

2026-08-24Patch availablerecord updated
2026-07-23Patch availablerecord updated
2026-06-15Patch availablerecord updated
2026-06-09Publishedweakness classified, att&ck mapped

Affected products

Microsoft Corpcommercial · USaka microsoft, microsoft corporation
- Visual Studio CodeDesktop AppOn-premConsumer Software / ide-editor
- Visual Studio Code - MSSQL ExtensionDev ToolOn-premDevTools & CI / ide-editor

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable