CVE-2026-64809

HighCVSS 8.4

Published: 23/07/2026(UTC)Updated: 28/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

4th percentile - higher than 4% of all known CVEs

Summary

In JetBrains PhpStorm before 2026.2, arbitrary code execution was possible before granting project trust via the configured interpreter.

Risk Assessment

The risk includes arbitrary code execution by an attacker before project trust is granted, which could lead to compromise of the development environment.

Recommendation

Upgrade JetBrains PhpStorm to version 2026.2 or later.

Other vulnerabilities in JetBrains PhpStorm

CVE-2026-64808High
In JetBrains PhpStorm before 2026.2, arbitrary code execution was possible before granting project trust via project tooling.

Original NVD description (English source)

In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured interpreter