What is the CVSS score of CVE-2026-53914?

CVE-2026-53914 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Kotlin are affected by CVE-2026-53914?

JetBrains Kotlin versions prior to 2.4.20 contain a critical remote code execution vulnerability in build cache processing that could allow attackers with access to cached build artifacts to execute…. A patch is available.

How to fix or mitigate CVE-2026-53914?

Within 24 hours: Conduct inventory of all Kotlin installations and identify projects running versions prior to 2.4.20. Within 7 days: Upgrade all Kotlin installations to version 2.4.20 or later across development and CI/CD environments. Within 30 days: Perform build cache audit covering the past 90 days and validate integrity of all cached artifacts; confirm all active builds complete successfully with patched version.

Kotlin CVE-2026-53914

EUVD-2026-39659 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-06-26 JetBrains

Deserialization RCE Kotlin

Critical

Disputed · 9.8 NVD

Severity by source

Sources disagree (Medium–Critical)

Vendor (JetBrains) PRIMARY

MEDIUM

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Code execution gives full C/I/A, but the attacker must first obtain write/influence over the build cache (PR:L) and meet cache-consumption timing (AC:H), unlike the vendor's PR:N/AC:L.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 27, 2026 - 19:43 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 27, 2026 - 19:42 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 27, 2026 - 19:37 vuln.today

cvss_changed

Severity Changed

Jun 27, 2026 - 19:37 NVD

MEDIUM CRITICAL

CVSS changed

Jun 27, 2026 - 19:37 NVD

6.7 (MEDIUM) 9.8 (CRITICAL)

Patch available

Jun 26, 2026 - 15:01 EUVD

Analysis Generated

Jun 26, 2026 - 13:53 vuln.today

DescriptionNVD

In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata

AnalysisAI

Remote code execution in JetBrains Kotlin before 2.4.20 stems from unsafe deserialization (CWE-502) of build cache metadata, allowing an attacker who can influence cached build artifacts to execute arbitrary code during a build. The flaw carries a CVSS 9.8 (C:H/I:H/A:H) rating, but there is no public exploit identified at time of analysis and EPSS is very low (0.11%, 2nd percentile), and CISA SSVC marks exploitation as 'none'. …