CVE-2026-64815
CRITICAL
CVSS 9.8
intellij_idea
Verified Advisory
Arbitrary code injection in JetBrains IntelliJ IDEA via UI Designer form files (CVE-2026-64815)
JetBrains IntelliJ IDEA before version 2026.2 is affected by a vulnerability that allows arbitrary code injection through UI Designer form files. An attacker able to supply a malicious form file could achieve arbitrary code execution within the context of the IDE.
Affected versions:
- before 2026.2
We recommend updating to: 2026.2.
CVSS 9.8 · our assessment: act_now
Reference: https://www.jetbrains.com/privacy-security/issues-fixed/
Details: https://vuln.today/cve/CVE-2026-64815
Verified by vuln.today against published advisories.
Affected versions
- – before 2026.2
Fixed in: 2026.2
More advisories for intellij_idea
- CVE-2026-64811 – Arbitrary code execution in JetBrains IntelliJ IDEA via dev container configuration (CVE-2026-64811)
- CVE-2026-64812 – Unauthorized input injection in JetBrains IntelliJ IDEA Remote Development (CVE-2026-64812)
- CVE-2026-64814 – Unauthorized file access in JetBrains IntelliJ IDEA Remote Development (CVE-2026-64814)
- CVE-2026-64813 – Unauthorized settings modification in JetBrains IntelliJ IDEA Remote Development (CVE-2026-64813)