Skip to content
OpenAdvisories
High MSRC-CVE-2026-47292 1 CVE

Visual Studio Code MSSQL Extension Remote Code Execution Vulnerability

Published Jun 9, 2026 · Updated Sep 24, 2026 · Revision 3

Vendor: Microsoft

Summary

Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
The user would have be enticed to open a malicious file in vscode. Users should never open anything that they do not know or trust to be safe.

Security updates
1.43.0 — https://marketplace.visualstudio.com/items/ms-mssql.mssql/changelog

Vulnerabilities 1

  • High 7.8
    CVE-2026-47292

    Visual Studio Code MSSQL Extension Remote Code Execution Vulnerability

    Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to elevate privileges locally.

    Microsoft Visual Studio Code - MSSQL Extension

Revision history

  1. #3

    Updated the fixed version information and download link. The fix was previously believed to be included in Dynamics 365 Server (on-premises) version 6.2; however, it has been confirmed that the fix is included in Dynamics 365 Server v9.1 (on-premises) Update 1.45 (version 9.1.0045.0011). The download link, release notes, and build number has been updated accordingly in the Security Updates table. This is an informational change only.

  2. #2

    Affected software updated with new package information.

  3. #1

    Information published.

References