Quick answers
- Is CVE-2026-64808 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-64808 being exploited in the wild.
- How severe is CVE-2026-64808?
- High severity, with a CVSS score of 8.4, published 23 July 2026.
- Which products and versions are affected?
- Jetbrains PhpStorm before 2026.2.
- Is there a fix for CVE-2026-64808?
- A patch was published on 2026-07-23: Fixed in version 2026.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-64808 attacked?
- It is attacked with local access, in a network appliance.
- Am I affected by CVE-2026-64808?
- Check whether you run Jetbrains PhpStorm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A vulnerability in JetBrains PhpStorm (versions prior to 2026.2) allowed for arbitrary code execution by exploiting project tooling mechanisms. The flaw is categorized as CWE-829 (Inclusion of Functionality from Untrusted Control Sphere), where the IDE would execute scripts or binaries associated with project tools before the user explicitly confirmed the project was trusted. This local attack vector allows an attacker to achieve full system compromise (High Confidentiality, Integrity, and Availability impact) simply by having a user open a malicious project directory. The issue has been addressed in PhpStorm version 2026.2.
Affected products
- JetBrains PhpStorm before 2026.2
Timeline
- 2026-07-23: advisory: CVE-2026-64808 published by JetBrains
- 2026-07-23: patched: Fixed in version 2026.2