---
id: CVE-2026-118696
title: >-
  In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before
  2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026.3, 2026.2.4,
  2026.1.5.1, and 2025.3.5.2; Rider before 2026.3, 2026.2.4, 2026.1.5.3, and
  2025.3.5…
summary: >-
  In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before
  2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026.3, 2026.2.4,
  2026.1.5.1, and 2025.3.5.2; Rider before 2026.3, 2026.2.4, 2026.1.5.3, and
  2025.3.5…
severity: high
cvss: 8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-299
vendor: JetBrains
product: IntelliJ IDEA
affected:
  - intellij_idea >= 2026.2 < 2026.2.4
  - intellij_idea >= 2026.1 < 2026.1.5.1
  - intellij_idea < 2025.3.6.2
  - PyCharm >= 2026.2 < 2026.2.4
  - PyCharm >= 2026.1 < 2026.1.5.1
  - PyCharm < 2025.3.6.2
  - PhpStorm >= 2026.2 < 2026.2.4
  - PhpStorm >= 2026.1 < 2026.1.5.1
  - PhpStorm < 2025.3.6.2
  - RubyMine >= 2026.2 < 2026.2.4
  - RubyMine >= 2026.1 < 2026.1.5.1
  - RubyMine < 2025.3.6.2
  - WebStorm >= 2026.2 < 2026.2.4
  - WebStorm >= 2026.1 < 2026.1.5.1
  - WebStorm < 2025.3.6.2
  - GoLand >= 2026.2 < 2026.2.4
  - GoLand >= 2026.1 < 2026.1.5.1
  - GoLand < 2025.3.5.2
  - Rider >= 2026.2 < 2026.2.4
  - Rider >= 2026.1 < 2026.1.5.3
  - Rider < 2025.3.5.3
  - CLion >= 2026.2 < 2026.2.4.1
  - CLion >= 2026.1 < 2026.1.5.2
  - CLion < 2025.3.6.3
  - DataGrip >= 2026.2 < 2026.2.6.1
  - DataGrip >= 2026.1 < 2026.1.4.1
  - DataGrip < 2025.3.6.1
  - RustRover >= 2026.2 < 2026.2.5
  - RustRover >= 2026.1 < 2026.1.4.1
  - RustRover < 2025.3.7.1
  - DataSpell >= 2026.1 < 2026.1.3.1
  - DataSpell < 2025.3.3.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-30T00:00:00+00:00'
published: '2026-10-30'
updated: '2026-10-31'
sourceUpdated: '2026-10-31T03:56:43.807Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118696'
references:
  - url: 'https://www.jetbrains.com/privacy-security/issues-fixed/'
  - url: >-
      https://blog.jetbrains.com/security/2026/10/compromised-emudhra-certificates-ides/
  - url: 'https://emudhra.com/en/post/certificate-security-incident'
  - url: 'https://bugzilla.mozilla.org/show_bug.cgi?id=2083449'
tags:
  - cve.org
epss: 0.00273
epssPercentile: 0.1984
ingestedAt: '2026-11-05T16:24:31.531Z'
---

## Overview

In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.5.2; Rider before 2026.3, 2026.2.4, 2026.1.5.3, and 2025.3.5.3; CLion before 2026.3, 2026.2.4.1, 2026.1.5.2, and 2025.3.6.3; DataGrip before 2026.3, 2026.2.6.1, 2026.1.4.1, and 2025.3.6.1; RustRover before 2026.3, 2026.2.5, 2026.1.4.1, and 2025.3.7.1; DataSpell before 2026.1.3.1 and 2025.3.3.1, the embedded browser trusted revoked intermediate certificates

## Affected

- `intellij_idea >= 2026.2 < 2026.2.4`
- `intellij_idea >= 2026.1 < 2026.1.5.1`
- `intellij_idea < 2025.3.6.2`
- `PyCharm >= 2026.2 < 2026.2.4`
- `PyCharm >= 2026.1 < 2026.1.5.1`
- `PyCharm < 2025.3.6.2`
- `PhpStorm >= 2026.2 < 2026.2.4`
- `PhpStorm >= 2026.1 < 2026.1.5.1`
- `PhpStorm < 2025.3.6.2`
- `RubyMine >= 2026.2 < 2026.2.4`
- `RubyMine >= 2026.1 < 2026.1.5.1`
- `RubyMine < 2025.3.6.2`
- `WebStorm >= 2026.2 < 2026.2.4`
- `WebStorm >= 2026.1 < 2026.1.5.1`
- `WebStorm < 2025.3.6.2`
- `GoLand >= 2026.2 < 2026.2.4`
- `GoLand >= 2026.1 < 2026.1.5.1`
- `GoLand < 2025.3.5.2`
- `Rider >= 2026.2 < 2026.2.4`
- `Rider >= 2026.1 < 2026.1.5.3`
- `Rider < 2025.3.5.3`
- `CLion >= 2026.2 < 2026.2.4.1`
- `CLion >= 2026.1 < 2026.1.5.2`
- `CLion < 2025.3.6.3`
- `DataGrip >= 2026.2 < 2026.2.6.1`
- `DataGrip >= 2026.1 < 2026.1.4.1`
- `DataGrip < 2025.3.6.1`
- `RustRover >= 2026.2 < 2026.2.5`
- `RustRover >= 2026.1 < 2026.1.4.1`
- `RustRover < 2025.3.7.1`
- `DataSpell >= 2026.1 < 2026.1.3.1`
- `DataSpell < 2025.3.3.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.