jetbrains vulnerabilities

Recent CVEs affecting jetbrains products. 31 tracked.

jetbrains has 31 tracked vulnerabilities, 3 critical and 1 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 31. Most recent: 2026-08-17. Highest priority: CVE-2026-63077 (score 100/100).

CVE-2026-63077 CRITICAL 9.8 EXPLOITED UPGRADE JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
CVE-2026-64813 CRITICAL 10.0 UPGRADE In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Developme
CVE-2026-64812 CRITICAL 10.0 UPGRADE In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development ses
CVE-2026-64815 HIGH 8.1 UPGRADE In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files
CVE-2026-65906 HIGH 8.8 UPGRADE In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible
CVE-2026-64814 HIGH 8.6 UPGRADE In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session
CVE-2026-65908 HIGH 8.6 UPGRADE In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was poss
CVE-2026-64804 HIGH 8.4 UPGRADE In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via pr
CVE-2026-64805 HIGH 8.4 UPGRADE In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via pr
CVE-2026-64806 HIGH 8.4 UPGRADE In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via th
CVE-2026-64808 HIGH 8.4 UPGRADE In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via pr
CVE-2026-64809 HIGH 8.4 UPGRADE In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via th
CVE-2026-64802 HIGH 7.8 UPGRADE In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the G
CVE-2026-64803 HIGH 7.8 UPGRADE In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust via the
CVE-2026-64807 HIGH 7.8 UPGRADE In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter config
CVE-2026-64811 HIGH 7.8 UPGRADE In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust v
CVE-2026-64800 LOW 3.5 UPGRADE In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default
CVE-2026-64810 MEDIUM 4.3 UPGRADE In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent u
CVE-2026-75050 HIGH 7.1 UPGRADE In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters
CVE-2026-75048 HIGH 8.2 UPGRADE In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible
CVE-2026-75051 HIGH 8.1 UPGRADE In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible
CVE-2026-75060 HIGH 8.4 UPGRADE In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP tools
CVE-2026-75049 MEDIUM 6.5 UPGRADE In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles
CVE-2026-75056 HIGH 7.8 UPGRADE In JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was possible
CVE-2026-75054 MEDIUM 6.3 UPGRADE In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projec
CVE-2026-75057 MEDIUM 6.2 UPGRADE In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log
CVE-2026-75053 MEDIUM 5.4 UPGRADE In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint
CVE-2026-75055 MEDIUM 5.5 UPGRADE In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE
CVE-2026-75058 MEDIUM 5.5 UPGRADE In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers
CVE-2026-75059 MEDIUM 4.4 UPGRADE In JetBrains PyCharm before 2026.2.1 code execution via Quick Documentation was possible
CVE-2026-75052 LOW 3.6 UPGRADE In JetBrains IntelliJ IDEA before 2026.2.1 command execution via crafted Markdown preview content was possible

FAQ

How do I fix jetbrains vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is jetbrains being exploited right now?

Yes: 1 jetbrains CVE is on the CISA Known Exploited Vulnerabilities list, so patch it first.

Which jetbrains CVE should I patch first?

CVE-2026-63077 currently ranks highest (100/100): JetBrains TeamCity Deserialization of Untrusted Data Vulnerability.

Products

← Back to latest CVEs