IntelliJ IDEA CVE-2026-49367

Exploitation requires that the target IntelliJ IDEA instance (before 2026.1.1) has the guest user account / collaborative access enabled and that the attacker is admitted as a guest - this is the exact prerequisite named in the CVE description ('command execution was possible via the guest user account'). This corresponds to CVSS PR:L (a valid low-privileged guest identity is needed), so it is not unauthenticated exploitation against a default install. What limits exploitation: the feature exposing a guest account must be turned on (not the default for a solo developer setup), the attacker must be granted or obtain guest access, and the host must be running a vulnerable pre-2026.1.1 build. No end-user interaction beyond the victim hosting the session (UI:N) is indicated.

The signals conflict and should be weighed together. CVSS 3.1 rates this 8.8 (High) with AV:N/AC:L/PR:L/UI:N and full C/I/A impact, and CISA SSVC records Technical Impact as 'total' - meaning if exploited the consequences are severe. However, the exploitation-facing signals are all low: EPSS is 0.00% (0th percentile), SSVC Exploitation is 'none', SSVC Automatable is 'no', and there is no public exploit identified at time of analysis and no CISA KEV listing. The PR:L requirement is meaningful: an attacker must already hold or be granted the guest account, which is not a default anonymous-internet exposure, so realistic risk is bounded to environments that actually enable guest/collaborative access. This is best treated as a should-patch-promptly issue for teams using shared IDE sessions rather than an emergency for isolated single-user installs. Note a consistency caveat: the vector is marked AV:N yet the 'guest user account' phrasing implies an established collaboration or session context - verify the exact exposure model with JetBrains before assuming fully remote reachability.

An organization enables IntelliJ IDEA's collaborative/guest access, and a user who joins only as a guest - expected to have read or limited editing rights - instead invokes IDE functionality that spawns an OS command on the host. Leveraging the missing authorization check, the guest executes arbitrary commands in the host user's context, achieving code execution on the developer's machine. No public exploit is identified at time of analysis, and the low attack complexity (AC:L) means that once guest access is obtained the technical steps are not complex.