JetBrains Toolbox App EUVD-2026-114245

Exploitation requires two concurrent conditions: (1) the attacker must hold a fraudulent TLS certificate that chains to one of the compromised eMudhra intermediate CA certificates that the jetbrainsd daemon improperly trusts, and (2) the attacker must occupy a man-in-the-middle position on the network path between the vulnerable IntelliJ IDEA or Toolbox App instance and the endpoints it connects to. No special product configuration is needed - the flawed trust is in the default certificate-validation behavior of the daemon - but exploitation is LIMITED to versions before the fixes (Toolbox App 3.9.1/3.8.2, IntelliJ IDEA 2026.3/2026.2.4) and is constrained by the need for both a valid-chaining forged certificate and an active interception position, which is why the attack complexity is high despite requiring no authentication or user interaction.

This is a genuine high-priority issue rather than a CVSS-inflated one, driven primarily by the quality of the root-cause evidence rather than by exploitation telemetry. The underlying problem (CWE-295) is concrete and vendor-confirmed: the jetbrainsd daemon continued to trust intermediate CA certificates tied to the compromised eMudhra certificate-authority incident, so the trust failure is a known, real-world condition, not theoretical. The input assigns the act_now decision label and the issue was reported by JetBrains itself, which raises urgency. However, the signals also contain tension that defenders should weigh: the CVSS 3.1 vector is AV:N/PR:N/UI:N (favoring widespread exploitability) but AC:H, which correctly reflects that an attacker must both hold a fraudulent certificate chaining to the compromised intermediates AND occupy a man-in-the-middle position - a meaningful barrier that pushes this toward targeted rather than opportunistic, internet-wide exploitation. No EPSS score, KEV listing, or PoC reference is present in the supplied data, so exploitation probability cannot be quantified and there is no confirmation of active abuse. Net: treat as act_now for patching (trust-store flaw affecting widely used developer tooling, scope-changed impact), while recognizing the AC:H MITM precondition makes mass exploitation unlikely and the absence of EPSS/KEV/PoC means real-world exploitation is currently unproven.

An attacker who possesses a fraudulent certificate issued under the compromised eMudhra intermediate CAs and who can intercept the victim's network traffic (e.g., on a shared or hostile network) presents that forged chain to a vulnerable IntelliJ IDEA or Toolbox App instance; because the jetbrainsd daemon trusts the compromised intermediates, the TLS connection is accepted as valid, letting the attacker intercept or tamper with the IDE's encrypted traffic such as update or API channels. No public exploit identified at time of analysis; the high attack complexity reflects the dual requirement of a MITM position and a valid-chaining fraudulent certificate.