What is the CVSS score of EUVD-2026-48238?

EUVD-2026-48238 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of IntelliJ IDEA are affected by EUVD-2026-48238?

JetBrains IntelliJ IDEA Remote Development feature versions prior to 2026.2 contain a critical vulnerability (CVSS 10.0) enabling unauthorized modification of IDE configuration settings, creating…. A patch is available.

How to fix or mitigate EUVD-2026-48238?

Within 24 hours: identify and inventory all IntelliJ IDEA installations running versions before 2026.2 with Remote Development in use, assess business criticality of affected development workflows, and notify security and development leadership. Within 7 days: disable IntelliJ IDEA Remote Development across non-critical systems and development teams unless operationally essential, implement network-based access restrictions to Remote Development connections, and confirm whether JetBrains has released version 2026.2. Within 30 days: complete upgrade of all affected IntelliJ IDEA instances to version 2026.2 or later, or evaluate alternative development tools if patch availability extends beyond organizational risk tolerance.

IntelliJ IDEA EUVD-2026-48238

| CVE-2026-64813 CRITICAL

Client-Side Enforcement of Server-Side Security (CWE-602)

2026-07-23 cve@jetbrains.com

GHSA-7xqr-wvrf-3jr9

Authentication Bypass Intellij Idea JetBrains

10.0

CVSS 3.1 · Vendor: jetbrains

Severity by source

Vendor (jetbrains) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Authentication-bypass settings modification gives high integrity impact remotely with no auth (PR:N) and scope change to the backend host; confidentiality/availability impacts are not evidenced by the description, so rated lower.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L

Primary rating from Vendor (jetbrains).

CVSS VectorVendor: jetbrains

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 23, 2026 - 14:04 EUVD

Analysis Generated

Jul 23, 2026 - 12:53 vuln.today

CVE Published

Jul 23, 2026 - 12:18 cve.org

CRITICAL 10.0

DescriptionCVE.org

In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session

AnalysisAI

Unauthorized settings modification in JetBrains IntelliJ IDEA before 2026.2 allows attackers to alter configuration within an active Remote Development session without proper authorization, tagged by the vendor as an authentication bypass. Because Remote Development connects a local client to a remote backend IDE, tampering with settings can subvert the security boundary between client and host. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the vendor-assigned CVSS of 10.0 with scope change signals maximum theoretical severity.

Technical ContextAI

IntelliJ IDEA's Remote Development feature runs the full IDE backend on a remote host while a thin client renders the UI locally over an established session; settings and project configuration are synchronized across this channel. The vulnerability maps to CWE-602 (Client-Side Enforcement of Server-Side Security), meaning security decisions about what settings a session may change were enforced or trusted on the client side rather than authoritatively validated by the server/backend. As a result, a session could push settings changes the server should have rejected. Because IDE settings can control build tools, interpreters, run configurations, and plugin behavior, unauthorized modification is a pathway to code execution on the backend host rather than a cosmetic change.

RemediationAI

Vendor-released patch: IntelliJ IDEA 2026.2 - upgrade all IntelliJ IDEA instances used for Remote Development to 2026.2 or later, per the JetBrains fixed-issues page at https://www.jetbrains.com/privacy-security/issues-fixed/. Until every backend host is updated, reduce exposure by disabling or not initiating Remote Development sessions, and restrict network reachability of the Remote Development backend to trusted clients only (for example, require access over a VPN or SSH tunnel and block direct exposure of the backend listener to untrusted networks). Treat the trade-off explicitly: disabling Remote Development removes the affected functionality for developers who rely on it, while network restrictions preserve the feature but require that only vetted clients can reach a session. Since exact affected build numbers are not enumerated in the input, confirm your specific IDE build against the JetBrains advisory before assuming you are unaffected.