# CVE-2026-118696: JetBrains IDEs embedded browser trusted revoked certificates

Source: https://junglewise.ai/threats/cve-2026-118696-in-jetbrains-intellij-idea-pycharm-phpstorm-rubymine-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-118696 · Severity: high · CVSS 8 · Published 2026-10-30

JetBrains development tools (IntelliJ IDEA, PyCharm, and others) embedded a browser that trusted intermediate SSL certificates whose private keys were compromised by the certificate authority eMudhra. An attacker intercepting network traffic could impersonate websites and services to steal credentials, inject malicious code, or intercept sensitive development data.

Technologies: [Jetbrains CLion](https://junglewise.ai/threats/technologies/clion), [Jetbrains GoLand](https://junglewise.ai/threats/technologies/goland), [Jetbrains IntelliJ IDEA](https://junglewise.ai/threats/technologies/intellij-idea), [Jetbrains PhpStorm](https://junglewise.ai/threats/technologies/phpstorm), [Jetbrains PyCharm](https://junglewise.ai/threats/technologies/pycharm), [Jetbrains Resharper](https://junglewise.ai/threats/technologies/resharper), [Jetbrains Rider](https://junglewise.ai/threats/technologies/rider), [Jetbrains Toolbox App](https://junglewise.ai/threats/technologies/toolbox-app), [Jetbrains WebStorm](https://junglewise.ai/threats/technologies/webstorm). Vendors: [Jetbrains](https://junglewise.ai/threats/vendors/jetbrains).

## Quick answers

**Is CVE-2026-118696 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118696 being exploited in the wild.

**How severe is CVE-2026-118696?** High severity, with a CVSS score of 8, published 30 October 2026.

**Which products and versions are affected?** Jetbrains CLion before 2026.3, 2026.2.4.1, 2026.1.5.2, 2025.3.6.3, 2025.2.6.3; Jetbrains DataGrip before 2026.3, 2026.2.6.1, 2026.1.4.1, 2025.3.6.1, 2025.2.6.1; Jetbrains DataSpell before 2026.1.3.1, 2025.3.3.1, 2025.2.4.1; Jetbrains Gateway before 2026.3, 2026.2.4, 2026.1.4, 2025.3.3, 2025.2.6; and 10 more.

**Is there a fix for CVE-2026-118696?** Yes: fixed in IntelliJ IDEA: 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.4; PyCharm: 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.3; PhpStorm: 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.3; RubyMine: 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.3; WebStorm: 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.3; GoLand: 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.5.2, 2025.2.6.3; Rider: 2026.3 EAP 9, 2026.2.4, 2026.1.5.3, 2025.3.5.3; CLion: 2026.3 RC, 2026.2.4.1, 2026.1.5.2, 2025.3.6.3, 2025.2.6.3; DataGrip: 2026.3 RC, 2026.2.6.1, 2026.1.4.1, 2025.3.6.1, 2025.2.6.1; RustRover: 2026.3 EAP 8, 2026.2.5, 2026.1.4.1, 2025.3.7.1, 2025.2.6.1; DataSpell: 2026.1.3.1, 2025.3.3.1, 2025.2.4.1; Toolbox App: 3.9.1, 3.8.2; Gateway: 2026.3 RC, 2026.2.4, 2026.1.4, 2025.3.3, 2025.2.6; ReSharper: 2026.3 EAP9, 2026.2.4, 2026.1.5.3, 2025.3.5.3. Until then: If unable to update immediately, disable the embedded browser (JCEF) in your IDE via Help | Edit Custom VM Options by adding the line -Djavax.net.ssl.trustStore pointing to a cleaned certificate store with the affected eMudhra roots removed, or manually delete the two eMudhra root certificates (comodoaaaca and emsigneccrootcag3) from the bundled Java trust store using keytool. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-118696 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-118696?** Check whether you run Jetbrains CLion, Jetbrains DataGrip, Jetbrains DataSpell or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in IntelliJ IDEA: 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.4; PyCharm: 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.3; PhpStorm: 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.3; RubyMine: 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.3; WebStorm: 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.3; GoLand: 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.5.2, 2025.2.6.3; Rider: 2026.3 EAP 9, 2026.2.4, 2026.1.5.3, 2025.3.5.3; CLion: 2026.3 RC, 2026.2.4.1, 2026.1.5.2, 2025.3.6.3, 2025.2.6.3; DataGrip: 2026.3 RC, 2026.2.6.1, 2026.1.4.1, 2025.3.6.1, 2025.2.6.1; RustRover: 2026.3 EAP 8, 2026.2.5, 2026.1.4.1, 2025.3.7.1, 2025.2.6.1; DataSpell: 2026.1.3.1, 2025.3.3.1, 2025.2.4.1; Toolbox App: 3.9.1, 3.8.2; Gateway: 2026.3 RC, 2026.2.4, 2026.1.4, 2025.3.3, 2025.2.6; ReSharper: 2026.3 EAP9, 2026.2.4, 2026.1.5.3, 2025.3.5.3

If unable to update immediately, disable the embedded browser (JCEF) in your IDE via Help | Edit Custom VM Options by adding the line -Djavax.net.ssl.trustStore pointing to a cleaned certificate store with the affected eMudhra roots removed, or manually delete the two eMudhra root certificates (comodoaaaca and emsigneccrootcag3) from the bundled Java trust store using keytool.

## Technical details

Eight eMudhra intermediate certificates had their private keys compromised, allowing an attacker with network access to perform man-in-the-middle attacks. The affected IDEs bundle JetBrains Runtime (JBR) and embedded Chromium-based browser (JCEF) with hardcoded certificate trust stores that were not updated by OS patches. The fix revokes the compromised certificates and removes affected root CAs from the trust store.

## Affected products

- JetBrains IntelliJ IDEA before 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.4
- JetBrains PyCharm before 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.3
- JetBrains PhpStorm before 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.3
- JetBrains RubyMine before 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.3
- JetBrains WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.3
- JetBrains GoLand before 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.5.2, 2025.2.6.3
- JetBrains Rider before 2026.3, 2026.2.4, 2026.1.5.3, 2025.3.5.3
- JetBrains CLion before 2026.3, 2026.2.4.1, 2026.1.5.2, 2025.3.6.3, 2025.2.6.3
- JetBrains DataGrip before 2026.3, 2026.2.6.1, 2026.1.4.1, 2025.3.6.1, 2025.2.6.1
- JetBrains RustRover before 2026.3, 2026.2.5, 2026.1.4.1, 2025.3.7.1, 2025.2.6.1
- JetBrains DataSpell before 2026.1.3.1, 2025.3.3.1, 2025.2.4.1
- JetBrains Toolbox App before 3.9.1, 3.8.2
- JetBrains Gateway before 2026.3, 2026.2.4, 2026.1.4, 2025.3.3, 2025.2.6
- JetBrains ReSharper before 2026.3, 2026.2.4, 2026.1.5.3, 2025.3.5.3

## Timeline

- 2026-10-30: disclosed: eMudhra private key compromise disclosed and fixes released

## References

- [https://blog.jetbrains.com/security/2026/10/compromised-emudhra-certificates-ides/](https://blog.jetbrains.com/security/2026/10/compromised-emudhra-certificates-ides/)
- [https://bugzilla.mozilla.org/show_bug.cgi?id=2083449](https://bugzilla.mozilla.org/show_bug.cgi?id=2083449)

## Related threats

- [JetBrains PhpStorm automatic project file upload to deployment server](https://junglewise.ai/threats/cve-2026-123858-in-jetbrains-phpstorm-before-2026-3-project-files-could-be)
- [JetBrains PhpStorm XML external entity injection in PHPMD ruleset autodetection](https://junglewise.ai/threats/cve-2026-123857-in-jetbrains-phpstorm-before-2026-3-xxe-was-possible-in)
- [JetBrains Toolbox App nTLM hash disclosure via SVG icons](https://junglewise.ai/threats/cve-2026-123856-in-jetbrains-toolbox-app-before-3-6-1-ntlm-hash-disclosure-was)
- [JetBrains Toolbox App command injection via configuration URLs](https://junglewise.ai/threats/cve-2026-123855-in-jetbrains-toolbox-app-before-3-6-1-command-injection-was)
- [JetBrains PyCharm code execution via crafted Jupyter notebook widget](https://junglewise.ai/threats/cve-2026-123854-in-jetbrains-pycharm-before-2026-3-code-execution-was-possible)