Is CVE-2026-86502 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86502 being exploited in the wild.

How severe is CVE-2026-86502?

High severity, with a CVSS score of 8.4, published 7 September 2026.

Which products and versions are affected?

Jetbrains IntelliJ IDEA before 2026.2.2.

Is there a fix for CVE-2026-86502?

A patch was published on 2026-09-07: Fixed in version 2026.2.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-86502 attacked?

It is attacked with local access, in a web application.

Am I affected by CVE-2026-86502?

Check whether you run Jetbrains IntelliJ IDEA at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86502: JetBrains IntelliJ IDEA missing TLS and authentication in IJent gRPC server

CVE-2026-86502 · Severity: high · CVSS 8.4 · Published 2026-09-07

JetBrains IntelliJ IDEA is a widely-used integrated development environment that supports remote development via the IJent gRPC server. The server was missing TLS encryption and authentication controls, allowing an attacker with local access to the remote host to execute arbitrary code, potentially compromising developer machines and the code they work with.

Technologies: Jetbrains IntelliJ IDEA. Vendors: Jetbrains.

Quick answers

Is CVE-2026-86502 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86502 being exploited in the wild.
How severe is CVE-2026-86502?: High severity, with a CVSS score of 8.4, published 7 September 2026.
Which products and versions are affected?: Jetbrains IntelliJ IDEA before 2026.2.2.
Is there a fix for CVE-2026-86502?: A patch was published on 2026-09-07: Fixed in version 2026.2.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86502 attacked?: It is attacked with local access, in a web application.
Am I affected by CVE-2026-86502?: Check whether you run Jetbrains IntelliJ IDEA at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authentication and encryption bypass in the IJent gRPC server component within IntelliJ IDEA's remote development feature. The gRPC server lacked both TLS (transport security) and authentication mechanisms, allowing any local user on the remote development host to communicate with and control the server. An attacker with local access to the remote machine can exploit this to achieve arbitrary remote code execution with the privileges of the IDE process. The vulnerability affects versions before 2026.2.2; a patch is available in version 2026.2.2 and later.

Affected products

JetBrains IntelliJ IDEA before 2026.2.2

Timeline

2026-09-07: disclosed: CVE-2026-86502 published
2026-09-07: patched: Fixed in version 2026.2.2

References

https://www.jetbrains.com/privacy-security/issues-fixed/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.