JetBrains IntelliJ IDEA

CVE-2026-86502

HIGH 8.4

At a glance

Source: NVD
EPSS: EPSS 0.21 % · percentile 11 (2026-10-31)
State: PUBLISHED
Published: 2026-09-07 16:26 UTC
Updated: 2026-09-09 04:25 UTC
Assigner: JetBrains
NVD status: Awaiting Analysis

Search on…

Description

In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts

Weaknesses (CWE)

CWE-306 — Missing Authentication for Critical Functionality

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 8.4	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	JetBrains
CVSS 3.1	HIGH 8.4	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · cve@jetbrains.com (Secondary)

European references

ENISA EUVD · EUVD-2026-72518
GCVE · GCVE-0-2026-86502

Affected products

Product	Versions
JetBrains · IntelliJ IDEA	affected 0 < 2026.2.2

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD