Vulnerability Intelligence Report
CVE-2026-118697
In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand and Rider before 2026.3 and 2026.2.4; CLion before 2026.3 and 2026.2.4.1; DataGrip before 2026.3 and 2026.2.6.1; RustRover before 2026.3 and 2026.2.5, the jetbrainsd daemon trusted compromised intermediate certificates
No Active Exploit Signals
CVSS Base Score
9.0
CRITICAL
Exploitability:2.3
Impact Score:6.1
EPSS Probability:0.27%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-295 ↗CWE-295: Improper Certificate Validation
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| JetBrains | Toolbox App | 3.9 < 3.9.1 (affected), 0 < 3.8.2 (affected) |
| JetBrains | IntelliJ IDEA | 0 < 2026.2.4 (affected) |
| JetBrains | PyCharm | 0 < 2026.2.4 (affected) |
| JetBrains | PhpStorm | 0 < 2026.2.4 (affected) |
| JetBrains | RubyMine | 0 < 2026.2.4 (affected) |
| JetBrains | WebStorm | 0 < 2026.2.4 (affected) |
| JetBrains | GoLand | 0 < 2026.2.4 (affected) |
| JetBrains | Rider | 0 < 2026.2.4 (affected) |
| JetBrains | CLion | 0 < 2026.2.4.1 (affected) |
| JetBrains | DataGrip | 0 < 2026.2.6.1 (affected) |
| JetBrains | RustRover | 0 < 2026.2.5 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.275%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | JetBrains s.r.o. · Vendor · Czech Republic |
| Reserved | 2026-10-28T18:33:13 |
| Published | 2026-10-30T17:31:26 |
| Last Updated | 2026-11-02T16:19:28 |
Community Chatter & Buzz