Is CVE-2026-123837 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123837 being exploited in the wild.

How severe is CVE-2026-123837?

High severity, with a CVSS score of 7.8, published 6 November 2026.

Which products and versions are affected?

Jetbrains IntelliJ IDEA before 2026.3, 2026.2.1.

Is there a fix for CVE-2026-123837?

Yes: fixed in IntelliJ IDEA 2026.3, 2026.2.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-123837 attacked?

It is attacked with local access, in a web application.

Am I affected by CVE-2026-123837?

Check whether you run Jetbrains IntelliJ IDEA at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123837: JetBrains IntelliJ IDEA command injection in Tomcat run configurations

CVE-2026-123837 · Severity: high · CVSS 7.8 · Published 2026-11-06

IntelliJ IDEA is a development environment used by software engineers to write and test code. A flaw in how it handles Tomcat application server configurations allows an attacker to execute arbitrary commands on a developer's machine when they open an untrusted project, potentially compromising the entire development environment and any credentials stored there.

Technologies: Jetbrains IntelliJ IDEA. Vendors: Jetbrains.

Quick answers

Is CVE-2026-123837 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123837 being exploited in the wild.
How severe is CVE-2026-123837?: High severity, with a CVSS score of 7.8, published 6 November 2026.
Which products and versions are affected?: Jetbrains IntelliJ IDEA before 2026.3, 2026.2.1.
Is there a fix for CVE-2026-123837?: Yes: fixed in IntelliJ IDEA 2026.3, 2026.2.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123837 attacked?: It is attacked with local access, in a web application.
Am I affected by CVE-2026-123837?: Check whether you run Jetbrains IntelliJ IDEA at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: IntelliJ IDEA 2026.3, 2026.2.1

Technical details

Command injection vulnerability exists in IntelliJ IDEA's Tomcat run configuration handling when processing untrusted projects, particularly affecting WSL (Windows Subsystem for Linux) environments. The vulnerability allows arbitrary command execution with the privileges of the user running IntelliJ IDEA; exploitation requires a user to open a malicious project file containing crafted Tomcat configuration.

Affected products

JetBrains IntelliJ IDEA before 2026.3, 2026.2.1

Timeline

2026-11-06: disclosed

References

https://www.jetbrains.com/privacy-security/issues-fixed/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.