CVE-2026-123848High· 7.4▾ TwilightIn JetBrains IntelliJ IDEA before 2026.3 host name verification was missing for server TLS certificates
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
In JetBrains IntelliJ IDEA before 2026.3 host name verification was missing for server TLS certificates
intellij_idea < 2026.3Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-123837High· 7.8In JetBrains IntelliJ IDEA before 2026.3, 2026.2.1 command injection was possible in untrusted projects via Tomcat run configurations on WSL
CVE-2026-123838High· 7.8In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form file
CVE-2026-123840Medium· 4.7In JetBrains IntelliJ IDEA before 2026.3 hTML injection was possible in Remote Development editor tabs
CVE-2026-123841High· 7.8In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings archive
CVE-2026-123846Medium· 4.3In JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON Schema validation
CVE-2026-123853High· 7.8In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM options of the build process