What is the CVSS score of CVE-2026-64814?

CVE-2026-64814 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of IntelliJ IDEA are affected by CVE-2026-64814?

JetBrains IntelliJ IDEA versions before 2026.2 contain a file access control bypass in the Remote Development feature that allows remote attackers to read unauthorized files, creating material risk…. A patch is available.

How to fix or mitigate CVE-2026-64814?

Within 24 hours: identify all developers using IntelliJ Remote Development and restrict feature access to internal networks and trusted IP addresses only. Within 7 days: enable comprehensive file access auditing on remote development servers and consider disabling the feature for users without critical need for remote development capabilities. Within 30 days: monitor JetBrains security advisories for release of version 2026.2 or later, validate the patch in a pre-production environment, and plan immediate deployment to all affected systems.

IntelliJ IDEA CVE-2026-64814

EUVD-2026-48239 HIGH

Missing Authorization (CWE-862)

2026-07-23 cve@jetbrains.com

GHSA-893f-8w7m-vh3c

Authentication Bypass Intellij Idea JetBrains

8.6

CVSS 3.1 · Vendor: jetbrains

Severity by source

Vendor (jetbrains) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

8.6 HIGH

Network-reachable Remote Development backend with missing authorization (PR:N), read-only file access gives C:H/I:N/A:N, and reach beyond the IDE component justifies S:C.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (jetbrains).

CVSS VectorVendor: jetbrains

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 23, 2026 - 14:04 EUVD

Analysis Generated

Jul 23, 2026 - 12:53 vuln.today

CVE Published

Jul 23, 2026 - 12:18 cve.org

HIGH 8.6

DescriptionCVE.org

In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session

AnalysisAI

Unauthorized file access in JetBrains IntelliJ IDEA before 2026.2 allows remote attackers to read files they should not be able to reach during a Remote Development session, bypassing intended authorization controls (CWE-862). The high CVSS score (8.6) reflects a scope-changed confidentiality impact, meaning the exposure can extend beyond the vulnerable component to the host system serving the remote session. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Technical ContextAI

IntelliJ IDEA's Remote Development feature runs a backend (headless IDE) on a remote host while a thin client connects from the developer's workstation, brokering file, terminal, and project operations over the network. This vulnerability is a Missing Authorization weakness (CWE-862), where the backend fails to properly enforce access controls on file operations within an active Remote Development session, permitting retrieval of files outside the authorized scope. The vendor tag 'Authentication Bypass' and the scope-changed CVSS vector (S:C) indicate the authorization gap lets a session reach resources on the underlying host beyond the IDE's intended sandbox. No CPE strings were provided in the input, so exact affected build identifiers rely on the version bound 'before 2026.2'.

RemediationAI

Vendor-released patch: upgrade IntelliJ IDEA to 2026.2 or later, which remediates the unauthorized file access in Remote Development sessions; refer to the JetBrains fixed-issues advisory at https://www.jetbrains.com/privacy-security/issues-fixed/. If immediate upgrade is not possible, disable or avoid using Remote Development sessions on affected backends and restrict network access to the Remote Development backend port so only trusted clients on a controlled network segment can reach it - the trade-off is loss of remote IDE functionality until patched. Additionally, run Remote Development backends under least-privilege service accounts and on hosts that do not store sensitive files outside the intended project scope, limiting what an unauthorized read could expose.