Which products and versions are affected by CVE-2021-27084?

Affected: Maven For Java (Microsoft); Visual Studio Code (Microsoft); Visual Studio Code - Java Extension Pack versions >= 0.5.0. The full list is in the CVE brief.

Is CVE-2021-27084 being exploited in the wild?

It is not listed in any known-exploited vulnerabilities catalog.

Is CVE-2021-27084 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2021-27084?

No public exploit code is known.

Is there a fix for CVE-2021-27084?

Fixed versions are available, including Visual Studio Code publication, Visual Studio Code - Java Extension Pack publication.

How urgently should CVE-2021-27084 be patched?

Brandefense priority: patch immediately, because it is very likely to be exploited soon.

Request A Demo

Vulnerability Intelligence

CVE-2021-27084

High

Visual Studio Code Java Extension Pack Remote Code Execution Vulnerability

Published Mar 11, 2021 · Updated Aug 19, 2026

Key Facts

Patch immediately

CVE-2021-27084 is a high-severity vulnerability (CVSS 7.8 v3.1) affecting Maven For Java (Microsoft), Visual Studio Code (Microsoft), Visual Studio Code - Java Extension Pack.
It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
EPSS estimates a 62% probability of exploitation in the next 30 days.
Fixed versions are available, including Visual Studio Code publication, Visual Studio Code - Java Extension Pack publication.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.

CVSS v3.1

7.8

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

62%

Higher than 99.1% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

None known

Get the full CVE-2021-27084 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

Visual Studio Code Java Extension Pack Remote Code Execution Vulnerability

Affected Products

3 affected entries in total

Product	Affected versions	Fixed in
Maven For JavaMicrosoft	See advisory	n/a
Visual Studio CodeMicrosoft	See advisory	publication
Visual Studio Code - Java Extension Pack	>= 0.5.0	publication

Patched Releases

Visual Studio Code

publication

Visual Studio Code - Java Extension Pack