Loading story…
JetBrains released fixes for 18 vulnerabilities affecting multiple developer products, including IntelliJ IDEA, TeamCity, WebStorm, PhpStorm, PyCharm, and GoLand, with the most severe issues concentrated in IntelliJ IDEA Remote Development and TeamCity. Two IntelliJ IDEA flaws, CVE-2026-64812 and CVE-2026-64813, were rated CVSS 10.0 and could allow unauthorized input injection and unauthorized settings modification during Remote Development sessions in versions before 2026.2. JetBrains also fixed CVE-2026-64814, which exposed unauthorized file access in Remote Development, and CVE-2026-64815, an arbitrary code injection issue via UI Designer form files.
Several IDE vulnerabilities could be triggered before project trust was granted, allowing arbitrary code execution through project-local tooling or configured interpreters in WebStorm (CVE-2026-64804, CVE-2026-64805, CVE-2026-64806), PhpStorm (CVE-2026-64808, CVE-2026-64809), and PyCharm (CVE-2026-65908). TeamCity received fixes for CVE-2026-65907, a CVSS 9.1 remote code execution flaw in Git VCS roots, and CVE-2026-65906, a Kotlin DSL sandbox escape affecting versions before 2026.1.2 and 2025.11.6. The Canadian Centre for Cyber Security urged administrators to apply JetBrains’ updates, and available reporting said there was no confirmed in-the-wild exploitation or public proof-of-concept at the time of disclosure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
A July 23, 2026 report summarized that JetBrains had fixed 18 vulnerabilities across multiple products, with CVE-2026-64812 and CVE-2026-64813 in IntelliJ IDEA rated CVSS 10.0 and TeamCity flaws CVE-2026-65907 and CVE-2026-65906 also highlighted as severe. The report said JetBrains stated there was no public proof-of-concept or confirmed in-the-wild exploitation.
On July 23, 2026, the Canadian Centre for Cyber Security issued advisory AV26-739 about JetBrains security updates. The notice urged users and administrators to review JetBrains' guidance and apply updates for affected versions of GoLand, IntelliJ IDEA, and PhpStorm.
On July 23, 2026, JetBrains published security advisories and fixes for vulnerabilities affecting several developer products, including GoLand, IntelliJ IDEA, PhpStorm, PyCharm, TeamCity, and WebStorm. Fixed versions referenced in the sources include IntelliJ IDEA 2026.2, PhpStorm 2026.2, WebStorm 2026.2, PyCharm 2026.1.4/2026.2, and TeamCity 2026.1.2/2025.11.6.
Several vulnerability records state that JetBrains received or recorded multiple CVEs on July 23, 2026, affecting WebStorm, PhpStorm, IntelliJ IDEA, and related products. The issues include arbitrary code execution, unauthorized file access, input injection, and settings modification vulnerabilities.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
15 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcesecurityonline.info
Open sourcecyber.gc.ca
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
JetBrains released fixes for two security vulnerabilities affecting **IntelliJ IDEA** and **TeamCity**, including **CVE-2026-59792**, a path traversal flaw in IntelliJ IDEA that can lead to remote code execution. The issue stems from project workspace ID handling and affects versions before **2026.1.4** and **2026.2**. The vulnerability is classified as `CWE-23` and carries a high-severity `CVSS 9.6` rating, with potential for significant confidentiality and integrity impact. JetBrains also patched **CVE-2026-59794**, a stored cross-site scripting flaw in **TeamCity** caused by unsanitized agent-reported data on the cloud profile page. That issue affects versions before **2026.1.2** and is rated high severity. Public reporting said no in-the-wild exploitation had been confirmed at the time of disclosure, but the flaws pose risk to developer endpoints and CI/CD environments, prompting organizations using the affected products to update to the fixed releases published on JetBrains' security advisories page.
Jul 16, 2026
JetBrains has patched a high-severity vulnerability in TeamCity On-Premises, tracked as **`CVE-2026-44413`**, that can allow privilege escalation and expose parts of the TeamCity server API to unauthorized users. The company said affected deployments include TeamCity On-Premises **2025.11.4 and earlier**, and advised customers to upgrade to **TeamCity 2026.1** or apply the available security patch plugin. According to JetBrains, the flaw could expose sensitive data including API tokens, Git credentials, build secrets, logs, and user information, with higher risk in environments that permit inbound connections on non-standard ports or run build agents on the same host as the TeamCity server. The issue requires access to a TeamCity account, which attackers could obtain through brute force, credential stuffing, leaked credentials, social engineering, or enabled guest access, raising the prospect of follow-on compromise of cloud infrastructure, source code repositories, and software delivery pipelines. The disclosure comes against a backdrop of repeated TeamCity security incidents, including **`CVE-2024-27198`** and **`CVE-2024-27199`**, two critical flaws that allowed unauthenticated attackers to bypass authentication, take over servers, alter certificates and ports, and create supply-chain attack paths; those earlier bugs were fixed in **2023.11.4** after researchers warned they could lead to full server compromise.
Jun 29, 2026
Atlassian disclosed a critical Confluence vulnerability, **`CVE-2023-22515`**, that can let an attacker create unauthorized administrator accounts and potentially take over the entire environment. Atlassian assessed the flaw as likely falling between **9.0 and 10.0** in severity and urged defenders to restrict access to the vulnerable component until patches could be applied. Authorities warned that any internet-exposed vulnerable instance showing even minor anomalies should be treated as potentially compromised, with indicators including unexpected additions to the `confluence-administrators` group, unexplained user creation, requests to `/setup/*.action`, and evidence of `/setup/setupadministrator.action` in `atlassian-confluence-security.log`. Subsequent analysis indicated the flaw might also be exploitable without creating an administrator account, including through `/server-info.action`, and Microsoft reported signs of exploitation dating back to mid-September 2023. JetBrains later released fixes for critical TeamCity authentication bypass vulnerabilities affecting all on-premises server installations through version **`2023.11.3`**, resolving them in **`2023.11.4`**. The company said an unauthenticated attacker could send specially crafted HTTP(S) requests to bypass authentication or gain administrator-level access, and exploitation attempts had already been observed. JetBrains updated and checked its cloud-hosted service, while defenders running on-premises TeamCity were told to patch immediately and review systems for compromise after updating, underscoring the ongoing risk from exposed enterprise collaboration and CI/CD platforms that can be seized through admin-level access flaws.
Jun 29, 2026