Loading story…
JetBrains released security updates for unspecified vulnerabilities affecting Hub, IntelliJ IDEA, Rider, TeamCity, and YouTrack. Affected deployments include Hub before 2026.2.52366, IntelliJ IDEA before 2026.2.3, Rider before 2026.2.1, along with specified releases of TeamCity and YouTrack; advisory summaries also identify broader update thresholds across the 2026.2, 2026.1.4, and 2025.11.8 release lines.
The Canadian Centre for Cyber Security and Guyana National CIRT urged administrators to review JetBrains’ fixed-security-issues guidance and update affected installations. The available advisories do not identify CVE numbers, vulnerability classes, severity ratings, or evidence of active exploitation, but organizations using JetBrains development or collaboration infrastructure should prioritize validation and deployment of the applicable fixed versions.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security issued advisory AV26-979 concerning the JetBrains vulnerabilities and recommended that users and administrators review the security information and apply necessary updates.
JetBrains published a security advisory covering unspecified vulnerabilities affecting Hub, IntelliJ IDEA, Rider, TeamCity, and YouTrack. It identified fixed-version thresholds and directed users to its Fixed Security Issues information and available updates.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourcecirt.gy
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
JetBrains has issued security fixes for multiple products, with national cyber agencies and downstream scanners warning that **IntelliJ IDEA, YouTrack, Ktor, and PyCharm** contain vulnerabilities requiring updates. Advisories from the Canadian Centre for Cyber Security and Guyana National CIRT direct administrators to JetBrains' fixed-issues guidance and note that affected builds span several release lines, particularly across **IntelliJ IDEA** and **YouTrack** deployments. Tenable plugin coverage adds technical detail for the patched flaws, including **IntelliJ IDEA** issues such as `CVE-2026-75057` involving **git credential disclosure** and a broader set of six vulnerabilities tied to `CWE-611`, `CWE-77`, `CWE-78`, and `CWE-918`. For **YouTrack**, published fixes address `CVE-2026-75044`, `CVE-2026-75045`, `CVE-2026-75046`, `CVE-2026-75048`, and `CVE-2026-75050`, covering **missing authorization**, **authentication weaknesses**, **stored XSS**, and **denial-of-service** conditions; several are described as network-accessible with meaningful confidentiality, integrity, or availability impact. No exploitation activity or threat actor has been identified in the referenced notices, but organizations running affected versions are being urged to apply the patched releases.
Aug 21, 2026
JetBrains released fixes for **18 vulnerabilities** affecting multiple developer products, including **IntelliJ IDEA, TeamCity, WebStorm, PhpStorm, PyCharm, and GoLand**, with the most severe issues concentrated in IntelliJ IDEA Remote Development and TeamCity. Two IntelliJ IDEA flaws, **`CVE-2026-64812`** and **`CVE-2026-64813`**, were rated **CVSS 10.0** and could allow unauthorized input injection and unauthorized settings modification during Remote Development sessions in versions before **2026.2**. JetBrains also fixed **`CVE-2026-64814`**, which exposed unauthorized file access in Remote Development, and **`CVE-2026-64815`**, an arbitrary code injection issue via UI Designer form files. Several IDE vulnerabilities could be triggered **before project trust was granted**, allowing arbitrary code execution through project-local tooling or configured interpreters in **WebStorm** (`CVE-2026-64804`, `CVE-2026-64805`, `CVE-2026-64806`), **PhpStorm** (`CVE-2026-64808`, `CVE-2026-64809`), and **PyCharm** (`CVE-2026-65908`). **TeamCity** received fixes for **`CVE-2026-65907`**, a **CVSS 9.1** remote code execution flaw in Git VCS roots, and **`CVE-2026-65906`**, a Kotlin DSL sandbox escape affecting versions before **2026.1.2** and **2025.11.6**. The Canadian Centre for Cyber Security urged administrators to apply JetBrains’ updates, and available reporting said there was **no confirmed in-the-wild exploitation or public proof-of-concept** at the time of disclosure.
Jul 23, 2026
JetBrains released fixes for two security vulnerabilities affecting **IntelliJ IDEA** and **TeamCity**, including **CVE-2026-59792**, a path traversal flaw in IntelliJ IDEA that can lead to remote code execution. The issue stems from project workspace ID handling and affects versions before **2026.1.4** and **2026.2**. The vulnerability is classified as `CWE-23` and carries a high-severity `CVSS 9.6` rating, with potential for significant confidentiality and integrity impact. JetBrains also patched **CVE-2026-59794**, a stored cross-site scripting flaw in **TeamCity** caused by unsanitized agent-reported data on the cloud profile page. That issue affects versions before **2026.1.2** and is rated high severity. Public reporting said no in-the-wild exploitation had been confirmed at the time of disclosure, but the flaws pose risk to developer endpoints and CI/CD environments, prompting organizations using the affected products to update to the fixed releases published on JetBrains' security advisories page.
Jul 16, 2026