What’s Vulnerable › Vulnerabilities

CVE-2026-118697

• Severity: critical (CVSS 9.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-30 · updated 2026-10-31
• Weakness: CWE-295

Description

In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA before 2026.3 and 2026.2.4, the jetbrainsd daemon trusted compromised intermediate certificates

Summary

CVE-2026-118697 is a critical (CVSS 9) trust flaw in which the jetbrainsd daemon accepted compromised intermediate certificates, potentially allowing attackers to impersonate trusted components. It affects JetBrains Toolbox App before 3.9.1 and 3.8.2, and IntelliJ IDEA before 2026.3 and 2026.2.4. There is no evidence of active exploitation and it is not in CISA KEV. Update Toolbox App to 3.9.1 or 3.8.2 and IntelliJ IDEA to 2026.2.4 (or 2026.3) as applicable.

CVE-2026-118697 ثغرة ثقة حرجة (CVSS 9) حيث قبلت خدمة jetbrainsd شهادات وسيطة مخترقة، ما قد يسمح للمهاجمين بانتحال مكونات موثوقة. تؤثر على JetBrains Toolbox App قبل 3.9.1 و3.8.2، وعلى IntelliJ IDEA قبل 2026.3 و2026.2.4. لا توجد أدلة على استغلال نشط وهي غير مدرجة في CISA KEV. حدّثوا Toolbox App إلى 3.9.1 أو 3.8.2 وIntelliJ IDEA إلى 2026.2.4 (أو 2026.3) حسب الاقتضاء.

Affected products

• JetBrains IntelliJ IDEA: before 2026.2.4 — fixed in 2026.2.4
• JetBrains Toolbox App: from 3.9.0 before 3.9.1; before 3.8.2 — fixed in 3.9.1, 3.8.2

How to fix

Upgrade to a fixed version: JetBrains IntelliJ IDEA 2026.2.4; JetBrains Toolbox App 3.9.1, 3.8.2. Check the vendor advisory for mitigations.

References

• https://blog.jetbrains.com/security/2026/10/compromised-emudhra-certificates-ides/
• https://bugzilla.mozilla.org/show_bug.cgi?id=2083449
• https://emudhra.com/en/post/certificate-security-incident
• https://www.jetbrains.com/privacy-security/issues-fixed/

Get alerted when CVE-2026-118697 or the next vulnerability affects your stack