What is the CVSS score of EUVD-2026-39659?

EUVD-2026-39659 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Kotlin are affected by EUVD-2026-39659?

JetBrains Kotlin versions prior to 2.4.20 contain a critical remote code execution vulnerability in build cache processing that could allow attackers with access to cached build artifacts to execute…. A patch is available.

How to fix or mitigate EUVD-2026-39659?

Within 24 hours: Conduct inventory of all Kotlin installations and identify projects running versions prior to 2.4.20. Within 7 days: Upgrade all Kotlin installations to version 2.4.20 or later across development and CI/CD environments. Within 30 days: Perform build cache audit covering the past 90 days and validate integrity of all cached artifacts; confirm all active builds complete successfully with patched version.

Kotlin EUVD-2026-39659

| CVE-2026-53914 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-06-26 JetBrains

RCE Deserialization Kotlin JetBrains

Critical

Disputed · 9.8 NVD

Severity by source

Sources disagree (Medium–Critical)

Vendor (JetBrains) PRIMARY

MEDIUM

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Code execution gives full C/I/A, but the attacker must first obtain write/influence over the build cache (PR:L) and meet cache-consumption timing (AC:H), unlike the vendor's PR:N/AC:L.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 27, 2026 - 19:43 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 27, 2026 - 19:42 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 27, 2026 - 19:37 vuln.today

cvss_changed

Severity Changed

Jun 27, 2026 - 19:37 NVD

MEDIUM CRITICAL

CVSS changed

Jun 27, 2026 - 19:37 NVD

6.7 (MEDIUM) 9.8 (CRITICAL)

Patch available

Jun 26, 2026 - 15:01 EUVD

Analysis Generated

Jun 26, 2026 - 13:53 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

17 maven packages depend on org.jetbrains.kotlin:kotlin-gradle-plugin (13 direct, 4 indirect)

Ecosystem-wide dependent count for version 2.4.20-Beta1.

DescriptionNVD

In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata

AnalysisAI

Remote code execution in JetBrains Kotlin before 2.4.20 stems from unsafe deserialization (CWE-502) of build cache metadata, allowing an attacker who can influence cached build artifacts to execute arbitrary code during a build. The flaw carries a CVSS 9.8 (C:H/I:H/A:H) rating, but there is no public exploit identified at time of analysis and EPSS is very low (0.11%, 2nd percentile), and CISA SSVC marks exploitation as 'none'. JetBrains, who reported the issue, has released a fixed version (2.4.20).