Is CVE-2026-62422 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-62422 being exploited in the wild.

How severe is CVE-2026-62422?

Critical severity, with a CVSS score of 10, published 14 July 2026.

Is there a fix for CVE-2026-62422?

A patch was published on 2026-07-14: Fixes released in multiple version branches. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-62422 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-62422?

Check whether you run Jetbrains YouTrack at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62422: JetBrains YouTrack authentication bypass via direct database access

CVE-2026-62422 · Severity: critical · CVSS 10 · Published 2026-07-14

JetBrains YouTrack, a project management and issue tracking tool, is affected by a critical security flaw that allows unauthorized individuals to bypass authentication. By exploiting this vulnerability, an attacker could gain full administrative control over the system without needing a password. This could lead to the theft of sensitive project data, disruption of business operations, and total compromise of the application environment.

Technologies: Jetbrains YouTrack. Vendors: Jetbrains.

Quick answers

Is CVE-2026-62422 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-62422 being exploited in the wild.
How severe is CVE-2026-62422?: Critical severity, with a CVSS score of 10, published 14 July 2026.
Which products and versions are affected?: Jetbrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429.
Is there a fix for CVE-2026-62422?: A patch was published on 2026-07-14: Fixes released in multiple version branches. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62422 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-62422?: Check whether you run Jetbrains YouTrack at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authentication bypass vulnerability exists in JetBrains YouTrack due to missing authentication for critical functions (CWE-306). The flaw allows an unauthenticated attacker to gain administrative access via direct database access mechanisms. The vulnerability is exploitable over the network with low complexity and requires no user interaction. Successful exploitation grants the attacker full control over the YouTrack instance. The issue is resolved in versions 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429.

Affected products

JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429

Timeline

2026-07-14: advisory: Initial advisory publication by JetBrains and NVD.
2026-07-14: patched: Fixes released in multiple version branches.

References

https://www.jetbrains.com/privacy-security/issues-fixed/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.