# Microsoft patches 15 Developer Tools flaws

Published: 2026-09-08 · Severity: routine · Sectors: technology
Canonical: https://vorant.io/reports/8b7e9224-253d-5351-bd27-e18707627350/microsoft-patches-15-developer-tools-flaws

> Microsoft fixed 15 vulnerabilities across Visual Studio Code, .NET, ASP.NET Core, GitHub Copilot, Authenticator, and Xbox Gaming Services; the worst allows Workspace Trust bypass via malicious VS Code workspaces.

NCSC-NL issued an advisory summarizing 15 Microsoft-patched vulnerabilities spanning Developer Tools products, most notably Visual Studio Code, GitHub Copilot/VS Code integration, .NET, ASP.NET Core, Microsoft Authenticator, and Xbox Gaming Services. The most severe issue, CVE-2026-81376 (CVSS 9.6), allows an attacker to bypass VS Code's Workspace Trust protections by luring a victim into opening a specially crafted workspace, enabling code or command execution from untrusted content without explicit user consent. Successful exploitation requires social engineering the victim into importing and processing a malicious source file, so it is not remotely/unauthenticated exploitable.

Other notable issues include multiple additional VS Code security-bypass flaws (CVE-2026-70334, -78461, -78462, -81356, -81357, -81378, -81379, all CVSS 7.4-8.8), an ASP.NET Core denial-of-service (CVE-2026-57099, CVSS 7.5), a privilege escalation in Microsoft Authenticator (CVE-2026-80097, CVSS 8.6), and a privilege escalation in Xbox Gaming Services (CVE-2026-58611, CVSS 7.8). Several sensitive-data-disclosure issues affect .NET and GitHub Copilot/VS Code integration. No evidence of in-the-wild exploitation is mentioned; this is a routine coordinated patch release. Defenders should prioritize patching Visual Studio Code and its extensions given the volume and severity of Workspace Trust bypasses, apply the Authenticator and Xbox Gaming Services updates to prevent privilege escalation, and monitor for anomalous workspace/file imports as a detection opportunity.

## Mentioned in this report

- Vulnerabilities: CVE-2026-57099, CVE-2026-58611, CVE-2026-58649, CVE-2026-69304, CVE-2026-70334, CVE-2026-78461, CVE-2026-78462, CVE-2026-80097, CVE-2026-81356, CVE-2026-81357, CVE-2026-81376, CVE-2026-81377, CVE-2026-81378, CVE-2026-81379, CVE-2026-81380, CVE-2026-81381, CVE-2026-81383

## Detection guidance (public sample)

### VS Code Untrusted Workspace Execution

ATT&CK: T1204.001

Detects VS Code executing commands or spawning processes after loading an untrusted workspace—bypassing Workspace Trust via CVE-2026-81376 or related flaws. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: VS Code Untrusted Workspace Execution
description: Detects Code.exe spawning child processes or executing commands shortly
  after processing a workspace file from an untrusted source. This behavioural pattern
  indicates potential Workspace Trust bypass exploitation (CVE-2026-81376 and related).
  Generalises on the parent/child relation and the presence of workspace-related file
  activity followed by code execution, not specific file paths or malware hashes.
tags:
- attack.execution
- attack.t1204.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_vscode_parent:
    ParentImage|endswith: \Code.exe
  selection_suspicious_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \cscript.exe
    - \wscript.exe
  filter_legitimate:
    CommandLine|contains:
    - --version
    - --help
    - code --
  condition: selection_vscode_parent and selection_suspicious_child and not filter_legitimate
falsepositives:
- VS Code extensions legitimately spawning shell processes for build/debug tasks
- Developer environments running integrated terminals and task runners
level: medium
id: 9d23cd65-70b2-5647-9153-d07aaf2e5783
status: experimental
author: Vorant
```

### Suspicious VS Code Workspace or Extension Load

ATT&CK: T1204.002

Detects Code.exe reading workspace configuration or extension manifests from user-accessible temp/download directories—characteristic of social engineering attacks exploiting Workspace Trust bypasses. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious VS Code Workspace or Extension Load
description: Detects Code.exe accessing .vscode/settings.json, .vscode/extensions,
  or extension manifests from suspicious directories such as Downloads, Temp, or UNC
  paths. This behavioural pattern indicates potential Workspace Trust bypass exploitation
  (CVE-2026-81356, CVE-2026-81357, CVE-2026-81378, CVE-2026-81379) following social
  engineering of a victim to open an untrusted workspace.
tags:
- attack.execution
- attack.t1204.002
logsource:
  category: file_event
  product: windows
detection:
  selection_vscode:
    Image|endswith: \Code.exe
  selection_workspace_files:
    TargetFilename|contains:
    - .vscode\settings.json
    - .vscode\extensions
    - .vscode\extensions.json
    - package.json
  selection_suspicious_paths:
    TargetFilename|contains:
    - \Downloads\
    - \Temp\
    - \AppData\Local\Temp\
    - \\\\
  condition: selection_vscode and selection_workspace_files and selection_suspicious_paths
falsepositives:
- Developers legitimately cloning or extracting projects from Downloads into VS Code
- VS Code portable installations stored in Temp directories
level: medium
id: f324490c-d558-5429-952e-2be62b57ffeb
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0351.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/8b7e9224-253d-5351-bd27-e18707627350/microsoft-patches-15-developer-tools-flaws.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup