Is CVE-2026-118697 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118697 being exploited in the wild.

How severe is CVE-2026-118697?

Critical severity, with a CVSS score of 9, published 30 October 2026.

Which products and versions are affected?

Jetbrains CLion before 2026.3 RC, 2026.2.4.1, 2026.1.5.2, 2025.3.6.3, 2025.2.6.3; Jetbrains DataGrip before 2026.3 RC, 2026.2.6.1, 2026.1.4.1, 2025.3.6.1, 2025.2.6.1; Jetbrains DataSpell before 2026.1.3.1, 2025.3.3.1, 2025.2.4.1; Jetbrains Gateway before 2026.3 RC, 2026.2.4, 2026.1.4, 2025.3.3, 2025.2.6; and 10 more.

Is there a fix for CVE-2026-118697?

Yes: fixed in Toolbox App 3.9.1, 3.8.2; IntelliJ IDEA 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.4; PyCharm 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.3; PhpStorm 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.3; RubyMine 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.3; WebStorm 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.3; Rider 2026.3 EAP 9, 2026.2.4, 2026.1.5.3, 2025.3.5.3; CLion 2026.3 RC, 2026.2.4.1, 2026.1.5.2, 2025.3.6.3, 2025.2.6.3; DataSpell 2026.1.3.1, 2025.3.3.1, 2025.2.4.1; DataGrip 2026.3 RC, 2026.2.6.1, 2026.1.4.1, 2025.3.6.1, 2025.2.6.1; GoLand 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.5.2, 2025.2.6.3; RustRover 2026.3 EAP 8, 2026.2.5, 2026.1.4.1, 2025.3.7.1, 2025.2.6.1; Gateway 2026.3 RC, 2026.2.4, 2026.1.4, 2025.3.3, 2025.2.6; ReSharper 2026.3 EAP9, 2026.2.4, 2026.1.5.3, 2025.3.5.3; jetbrainsd 0.9.9728. Until then: If you cannot update immediately, manually remove the two affected eMudhra root certificates from your IDE's certificate store using keytool with the commands provided in the advisory, and disable the embedded browser (JCEF) by adding a flag to the IDE's custom VM options. These steps take about five minutes and are fully reversible. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-118697 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-118697?

Check whether you run Jetbrains CLion, Jetbrains DataGrip, Jetbrains DataSpell or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118697: JetBrains Toolbox App and IDEs compromised certificate trust

CVE-2026-118697 · Severity: critical · CVSS 9 · Published 2026-10-30

JetBrains development tools (IDEs, Toolbox App, Gateway) trust a set of intermediate certificates in their background service and embedded components. Eight of these eMudhra intermediate certificates had their private keys compromised, allowing a network attacker to impersonate websites and services that developers connect to—potentially enabling man-in-the-middle attacks, credential theft, or malicious code injection during development workflows.

Technologies: Jetbrains CLion, Jetbrains GoLand, Jetbrains IntelliJ IDEA, Jetbrains PhpStorm, Jetbrains PyCharm, Jetbrains Resharper, Jetbrains Rider, Jetbrains Toolbox App, Jetbrains WebStorm. Vendors: Jetbrains.

Quick answers

Is CVE-2026-118697 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118697 being exploited in the wild.
How severe is CVE-2026-118697?: Critical severity, with a CVSS score of 9, published 30 October 2026.
Which products and versions are affected?: Jetbrains CLion before 2026.3 RC, 2026.2.4.1, 2026.1.5.2, 2025.3.6.3, 2025.2.6.3; Jetbrains DataGrip before 2026.3 RC, 2026.2.6.1, 2026.1.4.1, 2025.3.6.1, 2025.2.6.1; Jetbrains DataSpell before 2026.1.3.1, 2025.3.3.1, 2025.2.4.1; Jetbrains Gateway before 2026.3 RC, 2026.2.4, 2026.1.4, 2025.3.3, 2025.2.6; and 10 more.
Is there a fix for CVE-2026-118697?: Yes: fixed in Toolbox App 3.9.1, 3.8.2; IntelliJ IDEA 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.4; PyCharm 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.3; PhpStorm 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.3; RubyMine 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.3; WebStorm 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.3; Rider 2026.3 EAP 9, 2026.2.4, 2026.1.5.3, 2025.3.5.3; CLion 2026.3 RC, 2026.2.4.1, 2026.1.5.2, 2025.3.6.3, 2025.2.6.3; DataSpell 2026.1.3.1, 2025.3.3.1, 2025.2.4.1; DataGrip 2026.3 RC, 2026.2.6.1, 2026.1.4.1, 2025.3.6.1, 2025.2.6.1; GoLand 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.5.2, 2025.2.6.3; RustRover 2026.3 EAP 8, 2026.2.5, 2026.1.4.1, 2025.3.7.1, 2025.2.6.1; Gateway 2026.3 RC, 2026.2.4, 2026.1.4, 2025.3.3, 2025.2.6; ReSharper 2026.3 EAP9, 2026.2.4, 2026.1.5.3, 2025.3.5.3; jetbrainsd 0.9.9728. Until then: If you cannot update immediately, manually remove the two affected eMudhra root certificates from your IDE's certificate store using keytool with the commands provided in the advisory, and disable the embedded browser (JCEF) by adding a flag to the IDE's custom VM options. These steps take about five minutes and are fully reversible. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118697 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-118697?: Check whether you run Jetbrains CLion, Jetbrains DataGrip, Jetbrains DataSpell or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Toolbox App 3.9.1, 3.8.2; IntelliJ IDEA 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.4; PyCharm 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.3; PhpStorm 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.3; RubyMine 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.3; WebStorm 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.3; Rider 2026.3 EAP 9, 2026.2.4, 2026.1.5.3, 2025.3.5.3; CLion 2026.3 RC, 2026.2.4.1, 2026.1.5.2, 2025.3.6.3, 2025.2.6.3; DataSpell 2026.1.3.1, 2025.3.3.1, 2025.2.4.1; DataGrip 2026.3 RC, 2026.2.6.1, 2026.1.4.1, 2025.3.6.1, 2025.2.6.1; GoLand 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.5.2, 2025.2.6.3; RustRover 2026.3 EAP 8, 2026.2.5, 2026.1.4.1, 2025.3.7.1, 2025.2.6.1; Gateway 2026.3 RC, 2026.2.4, 2026.1.4, 2025.3.3, 2025.2.6; ReSharper 2026.3 EAP9, 2026.2.4, 2026.1.5.3, 2025.3.5.3; jetbrainsd 0.9.9728

If you cannot update immediately, manually remove the two affected eMudhra root certificates from your IDE's certificate store using keytool with the commands provided in the advisory, and disable the embedded browser (JCEF) by adding a flag to the IDE's custom VM options. These steps take about five minutes and are fully reversible.

Technical details

The jetbrainsd background service and JetBrains Runtime (JBR) bundle trust a set of intermediate CA certificates; eight eMudhra-issued intermediate certificates (for TLS and code-signing) had their private keys compromised and can be trivially regenerated. A network-positioned attacker can intercept HTTPS connections from JetBrains tools and present valid certificates signed by the compromised intermediates, bypassing certificate validation. The embedded browser (JCEF) in some versions also uses its own certificate list unprotected by OS updates.

Affected products

JetBrains Toolbox App before 3.9.1 and 3.8.2
JetBrains IntelliJ IDEA before 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.4
JetBrains PyCharm before 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.3
JetBrains PhpStorm before 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.3
JetBrains RubyMine before 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.3
JetBrains WebStorm before 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.3
JetBrains Rider before 2026.3 EAP 9, 2026.2.4, 2026.1.5.3, 2025.3.5.3
JetBrains CLion before 2026.3 RC, 2026.2.4.1, 2026.1.5.2, 2025.3.6.3, 2025.2.6.3
JetBrains DataSpell before 2026.1.3.1, 2025.3.3.1, 2025.2.4.1
JetBrains DataGrip before 2026.3 RC, 2026.2.6.1, 2026.1.4.1, 2025.3.6.1, 2025.2.6.1
JetBrains GoLand before 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.5.2, 2025.2.6.3
JetBrains RustRover before 2026.3 EAP 8, 2026.2.5, 2026.1.4.1, 2025.3.7.1, 2025.2.6.1
JetBrains Gateway before 2026.3 RC, 2026.2.4, 2026.1.4, 2025.3.3, 2025.2.6
JetBrains ReSharper before 2026.3 EAP9, 2026.2.4, 2026.1.5.3, 2025.3.5.3

Timeline

2026-10-17: disclosed: eMudhra private key compromise reported to Mozilla
2026-10-30: advisory: JetBrains publishes security advisory and patches

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.