CVE-2026-47281Active Exploitation(microsoft / visual_studio_code)

MEDIUMCVSS 9.6 · CRITICAL

Exploitation observed; activity peaked at 4 mentions and remains active

Immediate actions

Patch microsoft visual_studio_code systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Missing authorization in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.

microsoft CVEs Back to dashboard

5.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47281

Weakness type (CWE)

CWE-306CWE-798CWE-862

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

visual_studio_code

Threat summary

Active exploitation appears in 3 classified signals
Public PoC is present in monitored signal
Patch or workaround signal is available
7 mentions across 4 observed days

What's happening

Active exploitation reported across 3 signals
PoC mentioned or linked in 2 signals
Patch or workaround mentioned in 2 signals
Technical details provided in 3 signals
General: 2 classified signals
Peaked 3d ago at 4 mentions (2026-06-10); latest day: 1
7 total mentions across 4 days

Affected systems

Vendors

microsoft

Products

visual_studio_code

Deep dive

Activity timeline7 mentions / 4d

Signal classification4 categories

Active Exploitation

342.9%

General

228.6%

Exploit

114.3%

Disclosure

114.3%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-10	4	Active Exploitation2General2
2026-06-16	1	Active Exploitation1
2026-06-21	1	Exploit1
2026-07-06	1	Disclosure1

Full discourse7 posts

OpenVPN Inc.@OpenVPN130d
Active Exploitation
Microsoft's record Patch Tuesday (200+ CVEs) patched six zero-days — then an unpatched Defender PoC called RoguePlanet (CVE-2026-47281) dropped the same afternoon. SYSTEM access on fully patched Win10/11. https://openv.pn/4uJ7Or7 #PatchTuesday #Windows
Post summary
Microsoft patched over 200 CVEs, but a PoC for CVE-2026-47281 called RoguePlanet was released, providing SYSTEM access on fully patched Windows 10/11, indicating active exploitation.
00011184
20.2K followersView on X
Divinmentis@Divinmentis135d
Active Exploitation
CVE-2026-47281 allows attackers to disable or bypass Windows Defender remotely before deploying secondary payloads. Exploitation confirmed by BleepingComputer, SecurityWeek, and The Hacker News. No official Microsoft patch confirmed yet. Mitigations are being circulated.
Post summary
Security outlets confirm real‑world exploitation of CVE‑2026‑47281, which lets attackers remotely disable Windows Defender before dropping secondary payloads. While no official patch exists yet, mitigations are currently being circulated.
1000063
18 followersView on X
Divinmentis@Divinmentis135d
Active Exploitation
⚠️ Zero-day alert: CVE-2026-47281 is being actively exploited in the wild. Tracked as "RoguePlanet" — it targets Microsoft Defender, the security layer protecting most Windows endpoints globally. If your Defender is unpatched, you are exposed right now. #CyberSecurity #ZeroDay
Post summary
The post claims CVE-2026-47281 is actively exploited against Microsoft Defender, highlighting an urgent risk for unpatched systems.
10000138
18 followersView on X
IntegSec@integ_sec110d
Disclosure
CVE-2026-47281: Visual Studio Code Privilege Escalation Vulnerability - What It Means for Your Business and How to Respond https://hubs.li/Q04nBYMS0
Post summary
The text announces CVE‑2026‑47281, a privilege escalation flaw in Visual Studio Code, and links to an article outlining business implications and response actions.
0000037
31 followersView on X
SHORT INFO@ShortInfoNews125d
Exploit
RoguePlanet (CVE-2026-47281) turns Microsoft Defender $MSFT against the PC it protects: a local attacker gets full SYSTEM control on Windows 10 and 11, even fully patched machines. Microsoft left it unpatched in June. BleepingComputer reports a working exploit is public.
Post summary
The post announces CVE-2026-47281, noting a publicly available working exploit granting local SYSTEM control on Windows 10 and 11, even on fully patched systems, though it does not confirm active exploitation.
0000091
155 followersView on X
Divinmentis@Divinmentis135d
General
RoguePlanet CVE-2026-47281 is particularly dangerous because Defender is the last line of defense on most enterprise endpoints. Threat actors who neutralize it before detection can operate undetected. Patch status and threat actor attribution are still developing. Watch for a CISA KEV addition.
Post summary
The post notes CVE-2026-47281’s potential danger and pending patch status, but lacks specific technical details, PoC, or evidence of active exploitation.
0000059
18 followersView on X
WindowsForum@windowsforum136d
General
🪟 VS Code letting a random .code-workspace hand out SYSTEM is the dev equivalent of leaving your front door keys in the mailbox. This matters because workspaces/extensions are the new attack surface. #Windows #Microsoft #VSCode #Security #CVE https://windowsforum.com/threads/cve-2026-47281-vs-code-workspace-file-can-grant-system-privileges.424639/?utm_source=x&utm_medium=social&utm_campaign=news_node84 https://t.co/zrQXZZf6it
Post summary
The post highlights CVE‑2026‑47281 in VS Code, noting that a random .code‑workspace file can grant SYSTEM privileges, but it provides no PoC, exploit, patch, or evidence of active exploitation.
0000036
1.2K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	microsoft	visual_studio_code	-	-	-

Explore more

Back to dashboard microsoft CVEs visual_studio_code vulnerabilities

What researchers are saying

CVE-2026-47281

OpenVPN Inc.[verified]@OpenVPNActive Exploitation

Microsoft patched over 200 CVEs, but a PoC for CVE-2026-47281 called RoguePlanet was released, providing SYSTEM access on fully patched Windows 10/11, indicating active exploitation.

Divinmentis[verified]@DivinmentisActive Exploitation

Security outlets confirm real‑world exploitation of CVE‑2026‑47281, which lets attackers remotely disable Windows Defender before dropping secondary payloads. While no official patch exists yet, mitigations are currently being circulated.

Divinmentis[verified]@DivinmentisActive Exploitation

The post claims CVE-2026-47281 is actively exploited against Microsoft Defender, highlighting an urgent risk for unpatched systems.

IntegSec[verified]@integ_secDisclosure

The text announces CVE‑2026‑47281, a privilege escalation flaw in Visual Studio Code, and links to an article outlining business implications and response actions.

SHORT INFO[verified]@ShortInfoNewsExploit

The post announces CVE-2026-47281, noting a publicly available working exploit granting local SYSTEM control on Windows 10 and 11, even on fully patched systems, though it does not confirm active exploitation.

Divinmentis[verified]@DivinmentisGeneral

The post notes CVE-2026-47281’s potential danger and pending patch status, but lacks specific technical details, PoC, or evidence of active exploitation.

WindowsForum[verified]@windowsforumGeneral

The post highlights CVE‑2026‑47281 in VS Code, noting that a random .code‑workspace file can grant SYSTEM privileges, but it provides no PoC, exploit, patch, or evidence of active exploitation.