JetBrains PyCharm EUVD-2026-60259

Exploitation requires that the attacker have local access to the machine running PyCharm - or network access to the MCP service port if it has been exposed beyond localhost through port forwarding, container networking, or firewall misconfiguration. The Jupyter MCP tools feature must be active (i.e., the MCP integration must be enabled in PyCharm, which is implied by the description but not explicitly confirmed as a non-default configuration). No authentication credentials are required once the endpoint is reachable - this is the core of the CWE-306 finding. Exploitation is limited by the local attack vector: remote unauthenticated exploitation over the internet is not possible against default localhost-bound configurations. Privileged access to the operating system is not required; any user who can reach the socket can exploit it.

The CVSS base score of 8.4 (High) with vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects low complexity and no privileges required, but the local attack vector (AV:L) is the critical limiting factor - exploitation requires local or network access to the MCP service endpoint, typically bound on localhost. Real-world risk depends heavily on whether the MCP port is exposed beyond localhost, for instance via misconfigured port forwarding, shared developer workstations, or containerized environments with host networking. No EPSS score was available in the provided data, and the vulnerability is not currently listed in the CISA KEV catalog, so widespread automated exploitation has not been confirmed. That said, developer IDEs present a high-value target given the code and credentials they routinely handle, and even a mid-sized IT team in gliwice running PyCharm for data science work should treat this as urgent given the trivial exploitation complexity once access to the endpoint exists. No POC has been identified at time of analysis, which moderates immediate risk, but the attack complexity is low enough that exploitation is straightforward for anyone with access to the endpoint.

An attacker with local access to a machine running an unpatched PyCharm instance - such as a shared developer workstation or a CI/CD build host - connects directly to the locally-bound Jupyter MCP server endpoint without providing any credentials. The attacker sends a crafted MCP tool invocation requesting execution of arbitrary Python code, which the server processes and executes with the privileges of the PyCharm process, granting full access to the developer's files, secrets, and credentials stored in the IDE environment. No public exploit code has been identified at time of analysis, but the low attack complexity means the technique is straightforward to replicate.