Loading story…
Microsoft disclosed and coordinated fixes for command injection vulnerabilities affecting Visual Studio Code and the Azure azure-cli-mcp component, with both flaws allowing arbitrary code execution through improper validation of user-supplied input before it is passed to a system call. In Visual Studio Code, tracked as CVE-2026-21518 and ZDI-26-253, a remote attacker can achieve code execution in the context of the current user if a victim opens a malicious project containing a crafted mcp.json file; the issue was assigned a CVSS 7.8 rating and patched by Microsoft.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Microsoft patched and publicly disclosed the Visual Studio Code command injection flaw as CVE-2026-21518 in a coordinated advisory release. The vulnerability, tracked by ZDI as ZDI-26-253 / ZDI-CAN-29184, received a CVSS score of 7.8.
ZDI publicly disclosed the critical Azure command injection vulnerability as ZDI-26-226 / ZDI-CAN-28042. The issue was described as unauthenticated remote code execution in the context of the MCP server and assigned a CVSS score of 9.8.
Zero Day Initiative informed Microsoft that it intended to publicly disclose the Azure azure-cli-mcp vulnerability as a zero-day. This marked an escalation in the disclosure process after vendor coordination.
TrendAI Research reported a command injection vulnerability in Microsoft Visual Studio Code involving malicious mcp.json files to Microsoft. Opening a crafted project could allow arbitrary code execution in the context of the current user.
Trend Micro's Zero Day Initiative reported a command injection vulnerability in Microsoft Azure's azure-cli-mcp component to Microsoft. The flaw could allow unauthenticated remote attackers to execute arbitrary code over the network.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed and patched multiple **elevation of privilege** vulnerabilities affecting **Visual Studio Code** and its **JS Debug Extension**, including `CVE-2025-24039`, `CVE-2025-24042`, and `CVE-2026-41613`. The latest issue, `CVE-2026-41613`, is rated **Important** with a **CVSS 3.1 score of 8.8** and is described as a **session fixation** flaw mapped to `CWE-384` and `CWE-78`. Microsoft said the vulnerability affects Visual Studio Code itself, while the earlier 2025 advisories cover separate privilege-escalation bugs in the core product and the JS Debug Extension. According to Microsoft, exploitation of `CVE-2026-41613` requires **user interaction**, specifically convincing a target to open a malicious file in VS Code, and could allow an attacker to obtain the permissions of the **MCP Server’s managed identity**. Microsoft said the flaw was **not publicly disclosed** and **not exploited** at the time of release, assessed exploitation as **less likely**, and made a fix available; the issue was credited to **Elad Luz of Oasis Security** through coordinated disclosure.
Jun 29, 2026
Researchers disclosed multiple security flaws affecting AWS MCP components, including a local file inclusion bug in the AWS Remote MCP Server and a critical command injection issue in `aws-mcp-server`. Varonis said authenticated users could abuse AWS CLI shorthand syntax, specifically the `@=` operator passed through the `aws___call_aws` tool, to read arbitrary files from the underlying host even when `FileAccessMode=NO_ACCESS` was enabled. AWS assigned **CVE-2026-4270** to the file access restriction bypass and said the issue was fixed in `aws-api-mcp-server` version **1.3.9**; the exposure affected the public endpoint `aws-mcp.us-east-1.api.aws` as well as self-hosted or forked deployments. A separate flaw, tracked as **CVE-2026-5058** and published by Trend Micro's Zero Day Initiative as **ZDI-26-246**, allows unauthenticated remote code execution in `aws-mcp-server` because user-supplied input in the allowed-commands list is not properly validated before being used in a system call. ZDI rated the bug **CVSS 9.8** and said successful exploitation lets attackers run arbitrary code in the MCP server context; the advisory was released as a 0-day after the vendor rejected the report. The disclosures landed alongside another AWS bulletin for **CVE-2026-4269**, an improper S3 ownership verification issue in the Bedrock AgentCore Starter Toolkit, underscoring broader security concerns around MCP-related tooling and the need for immediate patching and review of derivative implementations.
Jun 29, 2026
Microsoft disclosed and patched **CVE-2026-41612**, an information disclosure flaw in **Visual Studio Code** caused by relative path traversal and path traversal issues. The vulnerability is mapped to **`CWE-23`** and **`CWE-22`** and could allow an unauthorized local attacker to disclose file system information, potentially exposing sensitive data on affected systems. Microsoft assigned the bug a **CVSS 3.1 score of 5.5** and said exploitation requires **user interaction**. The company rated the issue as having **high confidentiality impact** with **no integrity or availability impact**, assessed exploitation as **less likely**, and reported that the flaw was **not publicly disclosed** and **not exploited in the wild** at the time of publication. An official security fix is available through Microsoft's update guidance.
Jun 29, 2026