What is the CVSS score of CVE-2026-62422?

CVE-2026-62422 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of JetBrains YouTrack are affected by CVE-2026-62422?

JetBrains YouTrack self-hosted installations contain a critical authentication bypass vulnerability allowing unauthenticated attackers to gain full administrative access.. A patch is available.

How to fix or mitigate CVE-2026-62422?

Within 24 hours, inventory all YouTrack self-hosted instances and identify their current versions against the following patch thresholds by release train: 2026.1 must be at least version 13757, 2025.3 at least 148033, 2025.2 at least 148048, 2025.1 at least 148120, 2024.3 at least 148430, and 2024.2 at least 148429. Within 7 days, test the appropriate patched version for your release train in a non-production environment, then deploy to all production instances, prioritizing internet-accessible systems. Within 30 days, confirm all instances are patched, audit administrative access logs for exploitation attempts, reset credentials for all service accounts using YouTrack, and verify no unauthorized administrative accounts were created.

JetBrains YouTrack CVE-2026-62422

EUVD-2026-43656 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-14 JetBrains

GHSA-cfrg-hc6v-824g

Authentication Bypass Youtrack

10.0

CVSS 3.1 · Vendor: JetBrains

Severity by source

Vendor (JetBrains) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Network-reachable missing-auth bypass to admin with low complexity and no auth; impact stays within YouTrack's own authority, so S:U (9.8) rather than the vendor's S:C, pending confirmation of the 'direct database access' precondition.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (JetBrains).

CVSS VectorVendor: JetBrains

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 14, 2026 - 13:02 EUVD

Analysis Generated

Jul 14, 2026 - 10:49 vuln.today

CVE Published

Jul 14, 2026 - 10:17 cve.org

CRITICAL 10.0

DescriptionCVE.org

In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible

AnalysisAI

Authentication bypass in JetBrains YouTrack allows attackers to obtain full administrative access by leveraging a direct-database-access code path, per CWE-306 (missing authentication for a critical function). All self-hosted YouTrack builds prior to the 2026.1.13757 / 2025.3.148033 / 2025.2.148048 / 2025.1.148120 / 2024.3.148430 / 2024.2.148429 fix trains are affected, and JetBrains rates it CVSS 10.0. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Reach YouTrack instance over network

Delivery

Invoke unauthenticated direct-database code path

Exploit

Bypass authentication checks

Execution

Gain administrative access

Impact

Exfiltrate issue data and pivot to integrations

Access

Reach YouTrack instance over network

Delivery

Invoke unauthenticated direct-database code path

Exploit

Bypass authentication checks

Execution

Gain administrative access

Impact

Exfiltrate issue data and pivot to integrations

Vulnerability AssessmentAI

Exploitation	The core prerequisite named in the description is the 'direct database access' path that enables the authentication bypass to administrative access - the exact preconditions for reaching it (network-only versus some level of database or internal access) are not fully clear from the CVE text and should be confirmed against the JetBrains advisory. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0) describes a network-reachable, low-complexity, unauthenticated attack yielding full confidentiality, integrity and availability impact with scope change - the highest-priority profile possible. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker who can reach the YouTrack instance targets the unauthenticated code path implicated by the missing-authentication flaw and obtains administrative access to the tracker, then reads confidential project/issue data, tampers with tickets, and pivots into integrated source control or CI credentials stored or referenced in YouTrack. No public exploit is identified at time of analysis, and the low attack complexity (AC:L) means that once the technique is known, exploitation would require little sophistication.
Remediation	Vendor-released patch: upgrade to the corresponding fixed build for your release branch - 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, or 2024.2.148429 (choose the build at or above your current major.minor line). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all YouTrack self-hosted instances and identify their current versions against the following patch thresholds by release train: 2026.1 must be at least version 13757, 2025.3 at least 148033, 2025.2 at least 148048, 2025.1 at least 148120, 2024.3 at least 148430, and 2024.2 at least 148429. …

Threat intelligence, references, and detailed analysis are available after sign-in.