CVE-2026-118696High· 8.0▾ TwilightIn JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.5.2; Rider before 2026.3, 2026.2.4, 2026.1.5.3, and 2025.3.5…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.5.2; Rider before 2026.3, 2026.2.4, 2026.1.5.3, and 2025.3.5.3; CLion before 2026.3, 2026.2.4.1, 2026.1.5.2, and 2025.3.6.3; DataGrip before 2026.3, 2026.2.6.1, 2026.1.4.1, and 2025.3.6.1; RustRover before 2026.3, 2026.2.5, 2026.1.4.1, and 2025.3.7.1; DataSpell before 2026.1.3.1 and 2025.3.3.1, the embedded browser trusted revoked intermediate certificates
intellij_idea >= 2026.2 < 2026.2.4intellij_idea >= 2026.1 < 2026.1.5.1intellij_idea < 2025.3.6.2PyCharm >= 2026.2 < 2026.2.4PyCharm >= 2026.1 < 2026.1.5.1PyCharm < 2025.3.6.2PhpStorm >= 2026.2 < 2026.2.4PhpStorm >= 2026.1 < 2026.1.5.1PhpStorm < 2025.3.6.2RubyMine >= 2026.2 < 2026.2.4RubyMine >= 2026.1 < 2026.1.5.1RubyMine < 2025.3.6.2WebStorm >= 2026.2 < 2026.2.4WebStorm >= 2026.1 < 2026.1.5.1WebStorm < 2025.3.6.2GoLand >= 2026.2 < 2026.2.4GoLand >= 2026.1 < 2026.1.5.1GoLand < 2025.3.5.2Rider >= 2026.2 < 2026.2.4Rider >= 2026.1 < 2026.1.5.3Rider < 2025.3.5.3CLion >= 2026.2 < 2026.2.4.1CLion >= 2026.1 < 2026.1.5.2CLion < 2025.3.6.3DataGrip >= 2026.2 < 2026.2.6.1DataGrip >= 2026.1 < 2026.1.4.1DataGrip < 2025.3.6.1RustRover >= 2026.2 < 2026.2.5RustRover >= 2026.1 < 2026.1.4.1RustRover < 2025.3.7.1DataSpell >= 2026.1 < 2026.1.3.1DataSpell < 2025.3.3.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-86501Low· 2.8In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.log
CVE-2026-86502High· 8.4In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts
CVE-2026-86503Low· 3.3In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetching
CVE-2026-86504High· 7.8In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code execution
CVE-2026-86505Low· 3.3In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace
CVE-2026-117530Medium· 6.7In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted commands