Executive brief
JetBrains IntelliJ IDEA is a widely-used integrated development environment that supports remote development via the IJent gRPC server. The server was missing TLS encryption and authentication controls, allowing an attacker with local access to the remote host to execute arbitrary code, potentially compromising developer machines and the code they work with.
Technical details
The vulnerability is an authentication and encryption bypass in the IJent gRPC server component within IntelliJ IDEA's remote development feature. The gRPC server lacked both TLS (transport security) and authentication mechanisms, allowing any local user on the remote development host to communicate with and control the server. An attacker with local access to the remote machine can exploit this to achieve arbitrary remote code execution with the privileges of the IDE process. The vulnerability affects versions before 2026.2.2; a patch is available in version 2026.2.2 and later.
Affected products
- JetBrains IntelliJ IDEA before 2026.2.2
Timeline
- 2026-09-07: disclosed: CVE-2026-86502 published
- 2026-09-07: patched: Fixed in version 2026.2.2