EUVD-2026-48237
GHSA-995f-8qgf-h52p
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Network-reachable Remote Development channel with missing authentication (PR:N) and no user interaction; injection into the remote backend crosses a trust boundary (S:C) with full impact.
Primary rating from Vendor (jetbrains).
CVSS VectorVendor: jetbrains
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session
AnalysisAI
Authentication bypass via unauthorized input injection in JetBrains IntelliJ IDEA before 2026.2 allows remote attackers to inject unauthorized input into an active Remote Development session, undermining the trust boundary between client and backend host. Because the flaw stems from missing authentication (CWE-306) on a Remote Development channel and carries a maximal CVSS 10.0 with scope change, a successful attacker can influence code, files, or execution on the remote workspace. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that IntelliJ IDEA's Remote Development feature is actively in use and that the attacker can reach the Remote Development session/backend over the network; the described 'unauthorized input injection' targets that specific session channel, and the CWE-306 missing-authentication root cause means no credentials are needed once the channel is reachable (consistent with PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H yields the maximum 10.0: network-reachable, low complexity, no privileges, no user interaction, scope change, and full confidentiality/integrity/availability impact - an unusually severe profile consistent with the CWE-306 authentication-bypass tag. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach a developer's Remote Development session over the network injects unauthorized input into the channel without supplying any credentials, because the critical function lacks authentication. Leveraging the scope-changing full-impact nature of the flaw, the injected input could manipulate the remote workspace's code or execution, effectively pivoting into the developer's backend host. … |
| Remediation | Vendor-released patch: 2026.2 - upgrade JetBrains IntelliJ IDEA to 2026.2 or later, which remediates the missing-authentication flaw in Remote Development; consult the JetBrains security advisory at https://www.jetbrains.com/privacy-security/issues-fixed/ for build-specific guidance. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Disable JetBrains IntelliJ IDEA Remote Development feature unless operationally critical; if required, restrict network access to Remote Development servers via firewall rules limiting connections to known internal IP ranges and disable all external/remote access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Intellij Idea
View allUnauthorized settings modification in JetBrains IntelliJ IDEA before 2026.2 allows attackers to alter configuration with
Code execution via path traversal in JetBrains IntelliJ IDEA before 2026.1.4 and 2026.2 lets an attacker abuse improper
Arbitrary code injection in IntelliJ IDEA before version 2026.2 allows remote attackers to execute arbitrary code by con
In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin
In JetBrains IntelliJ IDEA before 2020.1, the license server could be resolved to an untrusted host in some cases. Rated
In several versions of JetBrains IntelliJ IDEA Ultimate, creating Task Servers configurations leads to saving a cleartex
In several JetBrains IntelliJ IDEA versions, creating remote run configurations of JavaEE application servers leads to s
In several JetBrains IntelliJ IDEA versions, a Spring Boot run configuration with the default setting allowed remote att
In several JetBrains IntelliJ IDEA Ultimate versions, an Application Server run configuration (for Tomcat, Jetty, Resin,
Command execution in JetBrains IntelliJ IDEA before 2026.1.1 allows a holder of the low-privileged guest user account to
Unauthorized file access in JetBrains IntelliJ IDEA before 2026.2 allows remote attackers to read files they should not
In several versions of JetBrains IntelliJ IDEA Ultimate, creating run configurations for cloud application servers leads
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today