IntelliJ IDEA EUVD-2026-48239

Exploitation requires the target to be running IntelliJ IDEA before 2026.2 with the Remote Development feature active - the vulnerability manifests specifically 'in a Remote Development session,' so a reachable Remote Development backend is the concrete prerequisite. The CVSS vector states AV:N/AC:L/PR:N/UI:N (no privileges, no user interaction, low complexity), so no additional authentication or victim action is indicated by the scoring; however, the phrase 'in a Remote Development session' suggests a session/deployment context must exist, which limits exposure to environments that have enabled and network-exposed Remote Development rather than default standalone IDE installations. Standalone (non-remote) IntelliJ usage is not indicated as affected, which is the primary limiting factor.

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N = 8.6) describes a network-reachable, low-complexity, unauthenticated read-only exposure with a scope change, which is genuinely serious for confidentiality. However, several mitigating realities lower practical urgency: exploitation requires an active Remote Development session/deployment, so this is not a flaw in every IntelliJ install but only those using the remote backend feature. No EPSS score was provided in the input, and there is no KEV listing and no public exploit identified, suggesting this is a disclosed-and-patched issue rather than one under active mass exploitation. The 'Authentication Bypass' tag is somewhat broader than the description, which specifies unauthorized file access (read) only - impact is confined to confidentiality (I:N/A:N), so no data tampering or denial of service is indicated. Note a possible tension: the vector states PR:N (unauthenticated), yet 'in a Remote Development session' implies an existing session context - verify with the vendor advisory whether an attacker needs an established session or can trigger this pre-authentication.

An attacker able to reach an IntelliJ IDEA Remote Development backend over the network abuses the missing authorization check to request files outside the authorized project scope, retrieving sensitive host files such as credentials, keys, or source outside the intended workspace. Because the scope is changed (S:C), the read can reach beyond the IDE component into the underlying host. No public proof-of-concept has been identified, and the low attack complexity means a working exploit would be straightforward once the request format is known.