JetBrains IDEs EUVD-2026-114244

Exploitation requires three concrete preconditions working together: (1) the victim must use the IDE's embedded browser to load an HTTPS resource (UI:R - it is not exercised by normal non-browser IDE use); (2) the attacker must occupy a network man-in-the-middle position able to intercept that TLS connection; and (3) the attacker must present a certificate chain built on a revoked eMudhra-issued intermediate that the embedded browser fails to reject. The limiting factors are therefore significant: without a revoked-but-previously-valid intermediate from the eMudhra compromise and an active interception position, the flaw is not reachable, and it does not apply to users who never invoke the embedded browser. The only complete fix stated by the vendor is updating to the fixed build for each product (IntelliJ IDEA/PyCharm/PhpStorm/RubyMine/WebStorm 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.6.2; GoLand 2026.3/2026.2.4/2026.1.5.1/2025.3.5.2; Rider 2026.3/2026.2.4/2026.1.5.3/2025.3.5.3; CLion 2026.3/2026.2.4.1/2026.1.5.2/2025.3.6.3; DataGrip 2026.3/2026.2.6.1/2026.1.4.1/2025.3.6.1; RustRover 2026.3/2026.2.5/2026.1.4.1/2025.3.7.1; DataSpell 2026.1.3.1/2025.3.3.1).

The signals are consistent and point to a real but conditional, not emergency, priority. The CVSS 3.1 vector (8.0, AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) encodes exactly the limiting factors that matter: no authentication to the IDE is needed (PR:N), but the attack is high-complexity (AC:H) and requires victim interaction (UI:R), and the scope change (S:C) plus C:H/I:H reflect that a successful man-in-the-middle can both read and tamper with TLS-protected traffic in the embedded browser. The vuln.today decision label is 'this_week' rather than act_now/emergency, which aligns with the absence of exploitation signals: no CISA KEV listing, no EPSS score, and no PoC are present in the input, so there is no public exploit identified at time of analysis. The flaw is a certificate-revocation-checking failure (CWE-299) that became exploitable because of the external eMudhra CA compromise referenced by JetBrains - so real-world risk is gated on an attacker actually possessing one of the compromised/revoked intermediate certificates and holding a network interception position, which makes this better characterized as a targeted MITM risk than a mass-exploitable issue. Net: a genuine high-severity confidentiality/integrity exposure for developers using the embedded browser, but practical exploitation requires several aligned preconditions rather than being trivially remote.

An attacker positioned to intercept network traffic (e.g., shared/hostile Wi‑Fi, compromised upstream, or rogue proxy) presents a revoked eMudhra-issued intermediate certificate to a developer whose JetBrains IDE embedded browser is loading an HTTPS resource. Because the embedded browser trusts the revoked intermediate instead of rejecting it, the TLS session is silently intercepted, letting the attacker read and modify the content the developer sees or submits. No public exploit is identified at time of analysis, and success depends on the attacker controlling a chain anchored by the compromised certificates and on the user actively using the embedded browser (AC:H, UI:R).