JetBrains YouTrack EUVD-2026-60244

Exploitation requires that the YouTrack instance be network-reachable by the attacker and that the shared-draft-signature mechanism be usable to reach the database-backup download function - the core prerequisite is simply an exposed, unpatched YouTrack server, since the CVSS vector is AV:N/AC:L/PR:N/UI:N (no authentication, no user interaction). Limiting factors: the target must be a self-hosted/Standalone instance running a version prior to 2025.3.156085 / 2026.1.13913 / 2026.2.18112 and reachable from the attacker's position; instances behind a VPN, IP allowlist, or authenticating proxy, and already-patched JetBrains Cloud instances, are not exposed. Whether a fully attacker-forged signature suffices or a leaked/observed draft-share link is needed is not specified in the available data and should be confirmed with the vendor.

Signals are largely aligned toward high real-world risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, score 9.1) indicates a remotely reachable, low-complexity, unauthenticated attack requiring no user interaction, with high confidentiality and integrity impact and no availability impact - consistent with silent bulk data theft rather than disruption. No EPSS score was provided, so exploitation probability cannot be quantified. It is not in CISA KEV and no POC or exploit code is referenced, so there is no evidence of active exploitation; risk is driven by ease of exploitation and the value of exposed data, not confirmed in-the-wild activity. The vendor-assigned I:H is worth scrutinizing: downloading a backup is fundamentally a read/disclosure action (Information Disclosure tag), and the high integrity rating likely reflects that leaked backups contain credentials enabling downstream tampering - verify the mechanism with JetBrains if integrity impact drives your decision.

A remote attacker with no account crafts a request presenting a shared-draft signature to the backup-download functionality of an internet-exposed YouTrack instance and retrieves a full database backup. The attacker then mines the archive offline for user records, issue contents, integration tokens, and password hashes, using recovered secrets to pivot into connected systems. No user interaction or authentication is required, and no public POC has been identified at time of analysis.