EUVD-2026-48238
GHSA-7xqr-wvrf-3jr9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Authentication-bypass settings modification gives high integrity impact remotely with no auth (PR:N) and scope change to the backend host; confidentiality/availability impacts are not evidenced by the description, so rated lower.
Primary rating from Vendor (jetbrains).
CVSS VectorVendor: jetbrains
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session
AnalysisAI
Unauthorized settings modification in JetBrains IntelliJ IDEA before 2026.2 allows attackers to alter configuration within an active Remote Development session without proper authorization, tagged by the vendor as an authentication bypass. Because Remote Development connects a local client to a remote backend IDE, tampering with settings can subvert the security boundary between client and host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target be running IntelliJ IDEA before 2026.2 with the Remote Development feature active and an accessible Remote Development session - this is the specific deployment mode named in the CVE. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are mixed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach or interpose on an IntelliJ IDEA Remote Development session sends configuration changes the backend should have rejected, altering IDE settings such as tool paths or run/build configuration to achieve unauthorized control over the remote host environment. Given the CVSS AV:N/AC:L/PR:N profile, this would require no authentication and low complexity, though the sparse description leaves the exact triggering mechanism unconfirmed. … |
| Remediation | Vendor-released patch: IntelliJ IDEA 2026.2 - upgrade all IntelliJ IDEA instances used for Remote Development to 2026.2 or later, per the JetBrains fixed-issues page at https://www.jetbrains.com/privacy-security/issues-fixed/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify and inventory all IntelliJ IDEA installations running versions before 2026.2 with Remote Development in use, assess business criticality of affected development workflows, and notify security and development leadership. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Intellij Idea
View allAuthentication bypass via unauthorized input injection in JetBrains IntelliJ IDEA before 2026.2 allows remote attackers
Code execution via path traversal in JetBrains IntelliJ IDEA before 2026.1.4 and 2026.2 lets an attacker abuse improper
Arbitrary code injection in IntelliJ IDEA before version 2026.2 allows remote attackers to execute arbitrary code by con
In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin
In JetBrains IntelliJ IDEA before 2020.1, the license server could be resolved to an untrusted host in some cases. Rated
In several versions of JetBrains IntelliJ IDEA Ultimate, creating Task Servers configurations leads to saving a cleartex
In several JetBrains IntelliJ IDEA versions, creating remote run configurations of JavaEE application servers leads to s
In several JetBrains IntelliJ IDEA versions, a Spring Boot run configuration with the default setting allowed remote att
In several JetBrains IntelliJ IDEA Ultimate versions, an Application Server run configuration (for Tomcat, Jetty, Resin,
Command execution in JetBrains IntelliJ IDEA before 2026.1.1 allows a holder of the low-privileged guest user account to
Unauthorized file access in JetBrains IntelliJ IDEA before 2026.2 allows remote attackers to read files they should not
In several versions of JetBrains IntelliJ IDEA Ultimate, creating run configurations for cloud application servers leads
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today