IntelliJ IDEA EUVD-2026-48238

Exploitation requires that the target be running IntelliJ IDEA before 2026.2 with the Remote Development feature active and an accessible Remote Development session - this is the specific deployment mode named in the CVE. It is not exploitable against standard local (non-Remote-Development) IntelliJ IDEA usage, which is the primary limiting factor. The CVSS vector (PR:N/UI:N) indicates no authentication and no user interaction are needed once a session is reachable, but the vendor description does not detail whether the attacker must be an existing session participant, be positioned on the network path, or reach a listening backend port; this reachability precondition is not confirmed from the available data and materially affects real-world exploitability.

The signals are mixed. JetBrains assigned a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), which implies remote, unauthenticated, low-complexity exploitation with scope change and total compromise of confidentiality, integrity, and availability - the maximum possible rating. However, the one-line description ('unauthorized settings modification was possible in a Remote Development session') is far more modest and does not by itself substantiate full C:H/I:H/A:H with S:C; the CVWE-602 root cause and 'Authentication Bypass' tag are consistent with an integrity/authorization defect, but the confidentiality and availability impacts appear inferred rather than described. No EPSS score, KEV entry, POC, or SSVC decision data was provided. The realistic priority is high for organizations actually running Remote Development (attacker-reachable backend sessions are a serious trust boundary), but the 10.0 rating should be treated with caution: CVSS claims network unauthenticated total compromise while the description only confirms unauthorized settings changes - verify exact impact and reachability with JetBrains before treating this as a wormable internet-facing 10.0.

An attacker who can reach or interpose on an IntelliJ IDEA Remote Development session sends configuration changes the backend should have rejected, altering IDE settings such as tool paths or run/build configuration to achieve unauthorized control over the remote host environment. Given the CVSS AV:N/AC:L/PR:N profile, this would require no authentication and low complexity, though the sparse description leaves the exact triggering mechanism unconfirmed. No public proof-of-concept has been identified at time of analysis.