Loading story…
JetBrains has issued security fixes for multiple products, with national cyber agencies and downstream scanners warning that IntelliJ IDEA, YouTrack, Ktor, and PyCharm contain vulnerabilities requiring updates. Advisories from the Canadian Centre for Cyber Security and Guyana National CIRT direct administrators to JetBrains' fixed-issues guidance and note that affected builds span several release lines, particularly across IntelliJ IDEA and YouTrack deployments.
Tenable plugin coverage adds technical detail for the patched flaws, including IntelliJ IDEA issues such as CVE-2026-75057 involving git credential disclosure and a broader set of six vulnerabilities tied to CWE-611, CWE-77, CWE-78, and CWE-918. For YouTrack, published fixes address CVE-2026-75044, CVE-2026-75045, CVE-2026-75046, CVE-2026-75048, and CVE-2026-75050, covering missing authorization, authentication weaknesses, stored XSS, and denial-of-service conditions; several are described as network-accessible with meaningful confidentiality, integrity, or availability impact. No exploitation activity or threat actor has been identified in the referenced notices, but organizations running affected versions are being urged to apply the patched releases.
See real exploitation activity before you spend the cycle.
10 events from the most recent confirmed update back to the earliest known activity.
On August 21, 2026, Guyana National CIRT published a JetBrains security notice summarizing affected versions of IntelliJ IDEA, Ktor, PyCharm, and YouTrack. The notice referenced JetBrains' August 17 advisory and the Canadian Centre for Cyber Security's August 18 advisory, and recommended applying updates.
On August 18, 2026, the Canadian Centre for Cyber Security published advisory AV26-825 about vulnerabilities affecting multiple JetBrains products. The notice urged users and administrators to review JetBrains' fixed security issues page and apply updates as they become available.
On August 17, 2026, JetBrains published and patched CVE-2026-75050 in YouTrack. The vulnerability is mapped to CWE-770 and affects versions prior to patched builds including 2026.1.13901 and 2026.2.17950.
On August 17, 2026, JetBrains published and patched CVE-2026-75048, a stored XSS vulnerability in YouTrack. The flaw is classified as CWE-79 and affects versions prior to 2026.2.18068.
On August 17, 2026, JetBrains published and patched CVE-2026-75046 affecting YouTrack. The issue is mapped to CWE-862 and fixed in YouTrack 2026.2.18112.
On August 17, 2026, JetBrains published and patched CVE-2026-75045 in YouTrack. The flaw is mapped to CWE-288 and affects versions prior to patched releases including 2025.3.156085 and 2026.1.13913.
On August 17, 2026, JetBrains published and patched CVE-2026-75044 affecting YouTrack. The vulnerability is classified as CWE-862 and impacts versions prior to patched YouTrack builds including 2025.3.156085, 2026.1.13914, and 2026.2.17917.
On August 17, 2026, JetBrains published and patched six IntelliJ IDEA vulnerabilities: CVE-2026-75052, CVE-2026-75053, CVE-2026-75054, CVE-2026-75055, CVE-2026-75056, and CVE-2026-75058. The issues affect versions prior to 2026.2.1 and are associated with CWEs including CWE-611, CWE-77, CWE-78, and CWE-918.
On August 17, 2026, JetBrains published and patched CVE-2026-75057, a Git credential disclosure issue in IntelliJ IDEA. The flaw is mapped to CWE-532 and affects versions prior to 2026.1.5.
JetBrains issued a security advisory dated August 17, 2026 covering fixed security issues in IntelliJ IDEA, Ktor, PyCharm, and YouTrack. The advisory identified multiple vulnerable version ranges and corresponding patched releases, including IntelliJ IDEA 2026.1.5 and 2026.2.1, Ktor 3.4.1, PyCharm 2026.2.1, and several YouTrack builds.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
9 references tracked. Mallory keeps watching after this page renders.
cirt.gy
Open sourcetenable.com
Open sourcetenable.com
Open sourcetenable.com
Open sourcetenable.com
Open sourcetenable.com
Open sourcetenable.com
Open sourcetenable.com
Open sourcemalware.news
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
JetBrains released fixes for **18 vulnerabilities** affecting multiple developer products, including **IntelliJ IDEA, TeamCity, WebStorm, PhpStorm, PyCharm, and GoLand**, with the most severe issues concentrated in IntelliJ IDEA Remote Development and TeamCity. Two IntelliJ IDEA flaws, **`CVE-2026-64812`** and **`CVE-2026-64813`**, were rated **CVSS 10.0** and could allow unauthorized input injection and unauthorized settings modification during Remote Development sessions in versions before **2026.2**. JetBrains also fixed **`CVE-2026-64814`**, which exposed unauthorized file access in Remote Development, and **`CVE-2026-64815`**, an arbitrary code injection issue via UI Designer form files. Several IDE vulnerabilities could be triggered **before project trust was granted**, allowing arbitrary code execution through project-local tooling or configured interpreters in **WebStorm** (`CVE-2026-64804`, `CVE-2026-64805`, `CVE-2026-64806`), **PhpStorm** (`CVE-2026-64808`, `CVE-2026-64809`), and **PyCharm** (`CVE-2026-65908`). **TeamCity** received fixes for **`CVE-2026-65907`**, a **CVSS 9.1** remote code execution flaw in Git VCS roots, and **`CVE-2026-65906`**, a Kotlin DSL sandbox escape affecting versions before **2026.1.2** and **2025.11.6**. The Canadian Centre for Cyber Security urged administrators to apply JetBrains’ updates, and available reporting said there was **no confirmed in-the-wild exploitation or public proof-of-concept** at the time of disclosure.
Jul 23, 2026
JetBrains released fixes for two security vulnerabilities affecting **IntelliJ IDEA** and **TeamCity**, including **CVE-2026-59792**, a path traversal flaw in IntelliJ IDEA that can lead to remote code execution. The issue stems from project workspace ID handling and affects versions before **2026.1.4** and **2026.2**. The vulnerability is classified as `CWE-23` and carries a high-severity `CVSS 9.6` rating, with potential for significant confidentiality and integrity impact. JetBrains also patched **CVE-2026-59794**, a stored cross-site scripting flaw in **TeamCity** caused by unsanitized agent-reported data on the cloud profile page. That issue affects versions before **2026.1.2** and is rated high severity. Public reporting said no in-the-wild exploitation had been confirmed at the time of disclosure, but the flaws pose risk to developer endpoints and CI/CD environments, prompting organizations using the affected products to update to the fixed releases published on JetBrains' security advisories page.
Jul 16, 2026
JetBrains has patched a high-severity vulnerability in TeamCity On-Premises, tracked as **`CVE-2026-44413`**, that can allow privilege escalation and expose parts of the TeamCity server API to unauthorized users. The company said affected deployments include TeamCity On-Premises **2025.11.4 and earlier**, and advised customers to upgrade to **TeamCity 2026.1** or apply the available security patch plugin. According to JetBrains, the flaw could expose sensitive data including API tokens, Git credentials, build secrets, logs, and user information, with higher risk in environments that permit inbound connections on non-standard ports or run build agents on the same host as the TeamCity server. The issue requires access to a TeamCity account, which attackers could obtain through brute force, credential stuffing, leaked credentials, social engineering, or enabled guest access, raising the prospect of follow-on compromise of cloud infrastructure, source code repositories, and software delivery pipelines. The disclosure comes against a backdrop of repeated TeamCity security incidents, including **`CVE-2024-27198`** and **`CVE-2024-27199`**, two critical flaws that allowed unauthenticated attackers to bypass authentication, take over servers, alter certificates and ports, and create supply-chain attack paths; those earlier bugs were fixed in **2023.11.4** after researchers warned they could lead to full server compromise.
Jun 29, 2026