# Jetbrains IntelliJ IDEA vulnerabilities Source: https://junglewise.ai/threats/technologies/intellij-idea Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/intellij-idea.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 51 vulnerabilities in Jetbrains IntelliJ IDEA: 24 in the last 7 days and 39 in the last 90 days, 4 of them critical and 0 exploited in the wild. The most recent, CVE-2026-123853, was published on 6 November 2026. 26 vulnerabilities in the last four weeks, up 2500% on the four before (1). 1 critical against 0. ## Counts - Last 7 days: 24 - Last 30 days: 26 - Last 90 days: 39 - All time: 51 (4 critical, 0 exploited in the wild) ## About Jetbrains IntelliJ IDEA An integrated development environment for Java and other programming languages. ## Latest Jetbrains IntelliJ IDEA vulnerabilities - [CVE-2026-123853: JetBrains IntelliJ IDEA code execution via JVM options in Safe Mode](https://junglewise.ai/threats/cve-2026-123853-in-jetbrains-intellij-idea-before-2026-3-2026-2-2-code-execution) (high, CVSS 7.8, published 6 Nov 2026) - [CVE-2026-123849: JetBrains IntelliJ IDEA code execution via Terraform File Watchers](https://junglewise.ai/threats/cve-2026-123849-in-jetbrains-intellij-idea-before-2026-3-code-execution-was) (high, CVSS 7, published 6 Nov 2026) - [CVE-2026-123848: JetBrains IntelliJ IDEA TLS hostname verification missing](https://junglewise.ai/threats/cve-2026-123848-in-jetbrains-intellij-idea-before-2026-3-host-name-verification) (high, CVSS 7.4, published 6 Nov 2026) - [CVE-2026-123847: JetBrains IntelliJ IDEA command execution via control characters in terminal completion](https://junglewise.ai/threats/cve-2026-123847-in-jetbrains-intellij-idea-before-2026-3-command-execution-was) (medium, CVSS 5.3, published 6 Nov 2026) - [CVE-2026-123846: JetBrains IntelliJ IDEA blind SSRF in JSON Schema validation](https://junglewise.ai/threats/cve-2026-123846-in-jetbrains-intellij-idea-before-2026-3-blind-ssrf-was-possible) (medium, CVSS 4.3, published 6 Nov 2026) - [CVE-2026-123844: JetBrains IntelliJ IDEA server-side request forgery in plugin repositories](https://junglewise.ai/threats/cve-2026-123844-in-jetbrains-intellij-idea-before-2026-3-ssrf-was-possible-via) (medium, CVSS 5.3, published 6 Nov 2026) - [CVE-2026-123842: JetBrains IntelliJ IDEA arbitrary file write via symlinks in plugin extraction](https://junglewise.ai/threats/cve-2026-123842-in-jetbrains-intellij-idea-before-2026-3-arbitrary-file-write) (high, CVSS 7.1, published 6 Nov 2026) - [CVE-2026-123841: JetBrains IntelliJ IDEA code execution via symlinks in settings archive](https://junglewise.ai/threats/cve-2026-123841-in-jetbrains-intellij-idea-before-2026-3-code-execution-was) (high, CVSS 7.8, published 6 Nov 2026) - [CVE-2026-123840: JetBrains IntelliJ IDEA HTML injection in Remote Development editor tabs](https://junglewise.ai/threats/cve-2026-123840-in-jetbrains-intellij-idea-before-2026-3-html-injection-was) (medium, CVSS 4.7, published 6 Nov 2026) - [CVE-2026-123839: JetBrains IntelliJ IDEA URL opening in Remote Development port forwarding](https://junglewise.ai/threats/cve-2026-123839-in-jetbrains-intellij-idea-before-2026-3-opening-arbitrary-urls) (medium, CVSS 4.7, published 6 Nov 2026) - [CVE-2026-123838: JetBrains IntelliJ IDEA code execution in Safe Mode via UI Designer](https://junglewise.ai/threats/cve-2026-123838-in-jetbrains-intellij-idea-before-2026-3-code-execution-was) (high, CVSS 7.8, published 6 Nov 2026) - [CVE-2026-123837: JetBrains IntelliJ IDEA command injection in Tomcat run configurations](https://junglewise.ai/threats/cve-2026-123837-in-jetbrains-intellij-idea-before-2026-3-2026-2-1-command) (high, CVSS 7.8, published 6 Nov 2026) - [CVE-2026-123311: JetBrains IntelliJ IDEA command execution in Markdown preview](https://junglewise.ai/threats/cve-2026-123311-in-jetbrains-intellij-idea-before-2026-3-2026-2-4-command) (medium, CVSS 5.3, published 6 Nov 2026) - [CVE-2026-123310: JetBrains IntelliJ IDEA Kotlin script arbitrary repository downloads](https://junglewise.ai/threats/cve-2026-123310-in-jetbrains-intellij-idea-before-2026-3-kotlin-scripts-could) (medium, CVSS 5.4, published 6 Nov 2026) - [CVE-2026-123309: JetBrains IntelliJ IDEA stored XSS in Markdown preview](https://junglewise.ai/threats/cve-2026-123309-in-jetbrains-intellij-idea-before-2026-3-2026-2-4-stored-xss-was) (medium, CVSS 6.1, published 6 Nov 2026) - [CVE-2026-123308: JetBrains IntelliJ IDEA code execution via document import](https://junglewise.ai/threats/cve-2026-123308-in-jetbrains-intellij-idea-before-2026-3-code-execution-via-the) (medium, CVSS 6.3, published 6 Nov 2026) - [CVE-2026-123307: JetBrains IntelliJ IDEA unauthenticated connection via run configurations](https://junglewise.ai/threats/cve-2026-123307-in-jetbrains-intellij-idea-before-2026-3-2026-2-4) (medium, CVSS 6.8, published 6 Nov 2026) - [CVE-2026-123306: JetBrains IntelliJ IDEA improper certificate validation in headless mode](https://junglewise.ai/threats/cve-2026-123306-in-jetbrains-intellij-idea-before-2026-3-improper-checks-allowed) (high, CVSS 7.4, published 6 Nov 2026) - [CVE-2026-123305: JetBrains IntelliJ IDEA path traversal in Dev Container archive unpacking](https://junglewise.ai/threats/cve-2026-123305-in-jetbrains-intellij-idea-before-2026-3-path-traversal-was) (high, CVSS 7.5, published 6 Nov 2026) - [CVE-2026-123304: JetBrains IntelliJ IDEA code execution via ShellCheck path](https://junglewise.ai/threats/cve-2026-123304-in-jetbrains-intellij-idea-before-2026-3-code-execution-in) (high, CVSS 7.8, published 6 Nov 2026) - [CVE-2026-123302: JetBrains IntelliJ IDEA code execution via script engine discovery](https://junglewise.ai/threats/cve-2026-123302-in-jetbrains-intellij-idea-before-2026-3-2026-2-4-2026-1-5-1) (high, CVSS 7.8, published 6 Nov 2026) - [CVE-2026-123301: JetBrains IntelliJ IDEA DOM-based XSS in OpenAPI preview error view](https://junglewise.ai/threats/cve-2026-123301-in-jetbrains-intellij-idea-before-2026-3-dom-based-xss-in-the) (high, CVSS 8.2, published 6 Nov 2026) - [CVE-2026-123293: JetBrains IntelliJ IDEA code execution via Terraform tool path](https://junglewise.ai/threats/cve-2026-123293-in-jetbrains-intellij-idea-before-2026-3-2026-2-4-code-execution) (high, CVSS 7.8, published 6 Nov 2026) - [CVE-2026-123278: JetBrains IntelliJ IDEA unauthenticated RMI endpoint code execution](https://junglewise.ai/threats/cve-2026-123278-in-jetbrains-intellij-idea-before-2026-3-code-execution-was) (medium, CVSS 6.7, published 6 Nov 2026) - [CVE-2026-118697: JetBrains Toolbox App and IDEs compromised certificate trust](https://junglewise.ai/threats/cve-2026-118697-in-jetbrains-toolbox-app-before-3-9-1-and-3-8-2-intellij-idea) (critical, CVSS 9, published 30 Oct 2026) ## Most severe Jetbrains IntelliJ IDEA vulnerabilities - [CVE-2026-64813: JetBrains IntelliJ IDEA unauthorized settings modification in Remote Development](https://junglewise.ai/threats/cve-2026-64813-jetbrains-intellij-idea-unauthorized-settings-modification-in) (critical, CVSS 10, published 23 Jul 2026) - [CVE-2026-64812: JetBrains IntelliJ IDEA unauthorized input injection in Remote Development session](https://junglewise.ai/threats/cve-2026-64812-jetbrains-intellij-idea-unauthorized-input-injection-in-remote) (critical, CVSS 10, published 23 Jul 2026) - [CVE-2026-59792: JetBrains IntelliJ IDEA code execution via path traversal in workspace ID handling](https://junglewise.ai/threats/cve-2026-59792-jetbrains-intellij-idea-code-execution-via-path-traversal-in) (critical, CVSS 9.6, published 10 Jul 2026) - [CVE-2026-118697: JetBrains Toolbox App and IDEs compromised certificate trust](https://junglewise.ai/threats/cve-2026-118697-in-jetbrains-toolbox-app-before-3-9-1-and-3-8-2-intellij-idea) (critical, CVSS 9, published 30 Oct 2026) - [CVE-2026-64814: JetBrains IntelliJ IDEA unauthorized file access in Remote Development](https://junglewise.ai/threats/cve-2026-64814-jetbrains-intellij-idea-unauthorized-file-access-in-remote) (high, CVSS 8.6, published 23 Jul 2026) - [CVE-2026-86502: JetBrains IntelliJ IDEA missing TLS and authentication in IJent gRPC server](https://junglewise.ai/threats/cve-2026-86502-jetbrains-intellij-idea-missing-tls-and-authentication-in-ijent) (high, CVSS 8.4, published 7 Sep 2026) - [CVE-2026-123301: JetBrains IntelliJ IDEA DOM-based XSS in OpenAPI preview error view](https://junglewise.ai/threats/cve-2026-123301-in-jetbrains-intellij-idea-before-2026-3-dom-based-xss-in-the) (high, CVSS 8.2, published 6 Nov 2026) - [CVE-2026-64815: JetBrains IntelliJ IDEA code injection in UI Designer](https://junglewise.ai/threats/cve-2026-64815-jetbrains-intellij-idea-code-injection-in-ui-designer) (high, CVSS 8.1, published 23 Jul 2026) - [CVE-2026-118696: JetBrains IDEs embedded browser trusted revoked certificates](https://junglewise.ai/threats/cve-2026-118696-in-jetbrains-intellij-idea-pycharm-phpstorm-rubymine-and) (high, CVSS 8, published 30 Oct 2026) - [CVE-2026-49367: JetBrains IntelliJ IDEA command execution via guest account](https://junglewise.ai/threats/cve-2026-49367-jetbrains-intellij-idea-command-execution-via-guest-account) (high, CVSS 8, published 29 May 2026) ## Vulnerabilities per week 26 vulnerabilities in the last four weeks, up 2500% on the four before (1). 1 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 7 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 5 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 1 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 2 | 1 | 0 | | 2 Nov 2026 | 24 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Jetbrains technologies - [Jetbrains YouTrack](https://junglewise.ai/threats/technologies/youtrack): 83 vulnerabilities - [Jetbrains TeamCity](https://junglewise.ai/threats/technologies/teamcity): 34 vulnerabilities - [Jetbrains Datalore](https://junglewise.ai/threats/technologies/datalore): 16 vulnerabilities - [Jetbrains Hub](https://junglewise.ai/threats/technologies/hub): 11 vulnerabilities - [Jetbrains Webstorm](https://junglewise.ai/threats/technologies/webstorm): 8 vulnerabilities - [Jetbrains GoLand](https://junglewise.ai/threats/technologies/goland): 7 vulnerabilities - [Jetbrains PyCharm](https://junglewise.ai/threats/technologies/pycharm): 7 vulnerabilities - [Jetbrains CLion](https://junglewise.ai/threats/technologies/clion): 6 vulnerabilities - [Jetbrains PhpStorm](https://junglewise.ai/threats/technologies/phpstorm): 6 vulnerabilities - [Jetbrains Rider](https://junglewise.ai/threats/technologies/rider): 4 vulnerabilities - [Jetbrains Toolbox App](https://junglewise.ai/threats/technologies/toolbox-app): 4 vulnerabilities - [Jetbrains Junie CLI](https://junglewise.ai/threats/technologies/junie-cli): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Jetbrains IntelliJ IDEA vulnerabilities", https://junglewise.ai/threats/technologies/intellij-idea, 9 November 2026.