Read the docs
TI-2026-83259 Aliases CVE-2026-118696GHSA-c5hv-w26w-w8h7

JetBrains IDEs trust revoked certificates in embedded browser

Priority LOW 37CWE-299Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand, Rider, CLion, DataGrip, RustRover and DataSpell are affected in builds before their fixed versions. The embedded browser fails to check revocation of intermediate certificates (CWE-299) and trusts revoked ones. An unauthenticated remote attacker needs user interaction and specific conditions to gain high confidentiality and integrity impact.

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

Description from the CNA

In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.5.2; Rider before 2026.3, 2026.2.4, 2026.1.5.3, and 2025.3.5.3; CLion before 2026.3, 2026.2.4.1, 2026.1.5.2, and 2025.3.6.3; DataGrip before 2026.3, 2026.2.6.1, 2026.1.4.1, and 2025.3.6.1; RustRover before 2026.3, 2026.2.5, 2026.1.4.1, and 2025.3.7.1; DataSpell before 2026.1.3.1 and 2025.3.3.1, the embedded browser trusted revoked intermediate certificates

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00273 19th percentileScored 2026-11-07
Fix Fixed IntelliJ IDEA (JetBrains): 2026.2.4, 2026.1.5.1, 2025.3.6.2PyCharm (JetBrains): 2026.2.4, 2026.1.5.1, 2025.3.6.2+9 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
JetBrainsIntelliJ IDEA2026.2 to before 2026.2.4; 2026.1 to before 2026.1.5.1; before 2025.3.6.22026.2.4, 2026.1.5.1, 2025.3.6.2Patch availableCNA
JetBrainsPyCharm2026.2 to before 2026.2.4; 2026.1 to before 2026.1.5.1; before 2025.3.6.22026.2.4, 2026.1.5.1, 2025.3.6.2Patch availableCNA
JetBrainsPhpStorm2026.2 to before 2026.2.4; 2026.1 to before 2026.1.5.1; before 2025.3.6.22026.2.4, 2026.1.5.1, 2025.3.6.2Patch availableCNA
JetBrainsRubyMine2026.2 to before 2026.2.4; 2026.1 to before 2026.1.5.1; before 2025.3.6.22026.2.4, 2026.1.5.1, 2025.3.6.2Patch availableCNA
JetBrainsWebStorm2026.2 to before 2026.2.4; 2026.1 to before 2026.1.5.1; before 2025.3.6.22026.2.4, 2026.1.5.1, 2025.3.6.2Patch availableCNA
JetBrainsGoLand2026.2 to before 2026.2.4; 2026.1 to before 2026.1.5.1; before 2025.3.5.22026.2.4, 2026.1.5.1, 2025.3.5.2Patch availableCNA
JetBrainsRider2026.2 to before 2026.2.4; 2026.1 to before 2026.1.5.3; before 2025.3.5.32026.2.4, 2026.1.5.3, 2025.3.5.3Patch availableCNA
JetBrainsCLion2026.2 to before 2026.2.4.1; 2026.1 to before 2026.1.5.2; before 2025.3.6.32026.2.4.1, 2026.1.5.2, 2025.3.6.3Patch availableCNA
JetBrainsDataGrip2026.2 to before 2026.2.6.1; 2026.1 to before 2026.1.4.1; before 2025.3.6.12026.2.6.1, 2026.1.4.1, 2025.3.6.1Patch availableCNA
JetBrainsRustRover2026.2 to before 2026.2.5; 2026.1 to before 2026.1.4.1; before 2025.3.7.12026.2.5, 2026.1.4.1, 2025.3.7.1Patch availableCNA
JetBrainsDataSpell2026.1 to before 2026.1.3.1; before 2025.3.3.12026.1.3.1, 2025.3.3.1Patch availableCNA
  • IntelliJ IDEA VendorJetBrains Affected 2026.2 to before 2026.2.4; 2026.1 to before 2026.1.5.1; before 2025.3.6.2 Fixed in 2026.2.4, 2026.1.5.1, 2025.3.6.2 Patch available CNA
  • PyCharm VendorJetBrains Affected 2026.2 to before 2026.2.4; 2026.1 to before 2026.1.5.1; before 2025.3.6.2 Fixed in 2026.2.4, 2026.1.5.1, 2025.3.6.2 Patch available CNA
  • PhpStorm VendorJetBrains Affected 2026.2 to before 2026.2.4; 2026.1 to before 2026.1.5.1; before 2025.3.6.2 Fixed in 2026.2.4, 2026.1.5.1, 2025.3.6.2 Patch available CNA
  • RubyMine VendorJetBrains Affected 2026.2 to before 2026.2.4; 2026.1 to before 2026.1.5.1; before 2025.3.6.2 Fixed in 2026.2.4, 2026.1.5.1, 2025.3.6.2 Patch available CNA
  • WebStorm VendorJetBrains Affected 2026.2 to before 2026.2.4; 2026.1 to before 2026.1.5.1; before 2025.3.6.2 Fixed in 2026.2.4, 2026.1.5.1, 2025.3.6.2 Patch available CNA
  • GoLand VendorJetBrains Affected 2026.2 to before 2026.2.4; 2026.1 to before 2026.1.5.1; before 2025.3.5.2 Fixed in 2026.2.4, 2026.1.5.1, 2025.3.5.2 Patch available CNA
  • Rider VendorJetBrains Affected 2026.2 to before 2026.2.4; 2026.1 to before 2026.1.5.3; before 2025.3.5.3 Fixed in 2026.2.4, 2026.1.5.3, 2025.3.5.3 Patch available CNA
  • CLion VendorJetBrains Affected 2026.2 to before 2026.2.4.1; 2026.1 to before 2026.1.5.2; before 2025.3.6.3 Fixed in 2026.2.4.1, 2026.1.5.2, 2025.3.6.3 Patch available CNA
  • DataGrip VendorJetBrains Affected 2026.2 to before 2026.2.6.1; 2026.1 to before 2026.1.4.1; before 2025.3.6.1 Fixed in 2026.2.6.1, 2026.1.4.1, 2025.3.6.1 Patch available CNA
  • RustRover VendorJetBrains Affected 2026.2 to before 2026.2.5; 2026.1 to before 2026.1.4.1; before 2025.3.7.1 Fixed in 2026.2.5, 2026.1.4.1, 2025.3.7.1 Patch available CNA
  • DataSpell VendorJetBrains Affected 2026.1 to before 2026.1.3.1; before 2025.3.3.1 Fixed in 2026.1.3.1, 2025.3.3.1 Patch available CNA

CPE names Threatist (inferred) · 5

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:jetbrains:intellij_idea:*:*:*:*:*:*:*:*——JetBrains
cpe:2.3:a:jetbrains:pycharm:*:*:*:*:*:*:*:*——JetBrains
cpe:2.3:a:jetbrains:phpstorm:*:*:*:*:*:*:*:*——JetBrains
cpe:2.3:a:jetbrains:webstorm:*:*:*:*:*:*:*:*——JetBrains
cpe:2.3:a:jetbrains:goland:*:*:*:*:*:*:*:*——JetBrains
  • cpe:2.3:a:jetbrains:intellij_idea:*:*:*:*:*:*:*:* Versions — — ·JetBrains
  • cpe:2.3:a:jetbrains:pycharm:*:*:*:*:*:*:*:* Versions — — ·JetBrains
  • cpe:2.3:a:jetbrains:phpstorm:*:*:*:*:*:*:*:* Versions — — ·JetBrains
  • cpe:2.3:a:jetbrains:webstorm:*:*:*:*:*:*:*:* Versions — — ·JetBrains
  • cpe:2.3:a:jetbrains:goland:*:*:*:*:*:*:*:* Versions — — ·JetBrains

Remediation

Update IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm to 2026.2.4, 2026.1.5.1 or 2025.3.6.2; GoLand to 2026.2.4, 2026.1.5.1 or 2025.3.5.2; Rider to 2026.2.4, 2026.1.5.3 or 2025.3.5.3; CLion to 2026.2.4.1, 2026.1.5.2 or 2025.3.6.3. DataGrip is fixed in 2026.2.6.1, 2026.1.4.1 or 2025.3.6.1; RustRover in 2026.2.5, 2026.1.4.1 or 2025.3.7.1; and DataSpell in 2026.1.3.1 or 2025.3.3.1.

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

  • Fix · CNA IntelliJ IDEA (JetBrains) Fixed in 2026.2.4, 2026.1.5.1, 2025.3.6.2
  • Fix · CNA PyCharm (JetBrains) Fixed in 2026.2.4, 2026.1.5.1, 2025.3.6.2
  • Fix · CNA PhpStorm (JetBrains) Fixed in 2026.2.4, 2026.1.5.1, 2025.3.6.2
  • Fix · CNA RubyMine (JetBrains) Fixed in 2026.2.4, 2026.1.5.1, 2025.3.6.2
  • Fix · CNA WebStorm (JetBrains) Fixed in 2026.2.4, 2026.1.5.1, 2025.3.6.2
  • Fix · CNA GoLand (JetBrains) Fixed in 2026.2.4, 2026.1.5.1, 2025.3.5.2
  • Fix · CNA Rider (JetBrains) Fixed in 2026.2.4, 2026.1.5.3, 2025.3.5.3
  • Fix · CNA CLion (JetBrains) Fixed in 2026.2.4.1, 2026.1.5.2, 2025.3.6.3
  • Fix · CNA DataGrip (JetBrains) Fixed in 2026.2.6.1, 2026.1.4.1, 2025.3.6.1
  • Fix · CNA RustRover (JetBrains) Fixed in 2026.2.5, 2026.1.4.1, 2025.3.7.1
  • Fix · CNA DataSpell (JetBrains) Fixed in 2026.1.3.1, 2025.3.3.1

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-118696
  2. 2026-10-30 CISA SSVC decision points changed
  3. 2026-10-30 Priority changed: MEDIUM → LOW
  4. 2026-10-30 Alias added: GHSA-c5hv-w26w-w8h7
  5. 2026-10-31 CISA SSVC decision points changed

References

Other 4

  • TI-2026-45031 Deserialization of untrusted data in JetBrains TeamCity KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-18053 In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-22884 In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-18054 In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible KEVCVSS 3.1HIGH 7.3
  • TI-2024-15905 In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible CVSS 3.1CRITICAL 9.8
  • TI-2024-24589 Insufficiently protected credentials in JetBrains IntelliJ IDEA CVSS 3.1CRITICAL 9.3
See all 787 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences