First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-69320

HighCVSS 8.8/10Last modified Oct 24, 2026

Description

Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Microsoft	Visual Studio Code	>= 1.0.0, < 1.132.1

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69320Release Notes, Vendor Advisory

Timeline

Published: Aug 11, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-693215.5Missing authentication for critical function in Windows Power Dependency Coordinator allows an authorized attacker to perform tampering loca CVE-2026-693228.0Double free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges over a network.CVE-2026-693237.8Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.CVE-2026-693247.8Access of resource using incompatible type ('type confusion') in Windows Performance Monitor allows an authorized attacker to elevate privil CVE-2026-693258.1Heap-based buffer overflow in Microsoft JScript allows an unauthorized attacker to execute code over a network.CVE-2026-693268.8Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network.CVE-2026-693277.4Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code locally.CVE-2026-693287.8Untrusted search path in Windows Storage allows an authorized attacker to elevate privileges locally.CVE-2026-693297.5Out-of-bounds read in BranchCache allows an unauthorized attacker to deny service over a network.CVE-2026-69338.8The Premmerce Dev Tools plugin for WordPress is vulnerable to Remote Code Execution via missing authorization in versions up to and includin CVE-2026-693317.0Use after free in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.CVE-2026-693328.0Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges over a network.

CVE-2026-69320: High severity, CVSS 8.8 | Vulnix