CVE-2021-27083: Microsoft Visual Studio Code Remote Development Extension RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityHigh CVSS (7.8) code execution with a very high EPSS percentile, though it requires user interaction and has no confirmed exploitation.

What it is

The Remote Development Extension for Visual Studio Code contains a remote code execution flaw. The record gives no root-cause detail beyond the CWE being 'insufficient information', so the exact mechanism is unknown, but the impact is code execution in the context of the user running VS Code.

Impact

An attacker who gets a victim to open a crafted workspace or remote development context could execute code with the privileges of the VS Code user, compromising confidentiality, integrity and availability.

Attack surface

The CVSS vector is local (AV:L) with user interaction required (UI:R) and no privileges required (PR:N), meaning the victim must open or interact with malicious content rather than being reached over the network directly.

Exploitation

Not listed in CISA KEV and no reference carries an exploit tag, but EPSS is high at 0.619 (99th percentile), indicating elevated predicted exploitation activity despite the absence of confirmed in-the-wild use.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2021-27083.
• Update the Remote Development Extension and VS Code to current supported versions.
• Restrict opening untrusted workspaces and remote development configurations; use workspace trust prompts.
• Run VS Code with least privilege and avoid opening repositories from untrusted sources.
• Monitor vendor advisories for follow-up guidance since the root cause is not detailed.

Detection

• Alert on VS Code or extension processes spawning unexpected child processes such as shells or scripting hosts.
• Monitor for unusual file writes or network connections originating from VS Code extension host processes.
• Audit extension installs and workspace opens from untrusted or external sources.
• Correlate endpoint telemetry for code execution shortly after a workspace or remote session is opened.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.