CVE-2026-65675: CoPilot Chat Security Feature Bypass Vulnerability

No cwe for this issue in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to bypass a security feature over a network.

CSIRTS triage

What: A security feature bypass vulnerability in Visual Studio Code CoPilot Chat Extension allows unauthorized attackers to bypass security controls.
Who is affected: Users of Visual Studio Code with the CoPilot Chat Extension installed that communicate over a network.
Urgency: High severity (CVSS 7.1); not currently exploited but remotely exploitable without authentication.
Action: Update Visual Studio Code CoPilot Chat Extension to a patched version when available.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Visual Studio Code CoPilot Chat Extension

Get an email when a new Visual Studio Code CoPilot Chat Extension advisory drops — max one per day, one-click unsubscribe.

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-656750.48% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 39% of all EPSS-scored CVEs.

CVE	CSIRTS overview	External
CVE-2026-65675	coverage & exploitation status	NVD · CVE.org

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.