CVE-2026-64812
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
In JetBrains IntelliJ IDEA before version 2026.2, unauthorized input injection is possible during a Remote Development session.
Risk Assessment
An attacker can manipulate input data in a remote session, potentially leading to unauthorized actions or data leakage.
Recommendation
Update IntelliJ IDEA to version 2026.2 or later.
Other vulnerabilities in JetBrains IntelliJ IDEA
See all- CVE-2026-41882High
In JetBrains IntelliJ IDEA versions before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, and 2026.1.1, it was possible to read arbitrary local files via the built-in web server.
- CVE-2026-86505Low
In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace.
- CVE-2026-86503Low
In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetching.
- CVE-2026-86501Low
In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.log.
- CVE-2026-75058Medium
In JetBrains IntelliJ IDEA before 2026.2.1 XXE was possible in the Eclipse settings importers.
- CVE-2026-75057Medium
In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log.
- CVE-2026-75056High
In JetBrains IntelliJ IDEA before 2026.2.1, remote code execution (RCE) was possible via the Markdown export tool.
- CVE-2026-75055Medium
In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE.
- CVE-2026-75054Medium
In JetBrains IntelliJ IDEA before 2026.2.1 SSRF was possible via the OpenAPI preview proxy in untrusted projects.
- CVE-2026-75053Medium
In JetBrains IntelliJ IDEA before 2026.2.1, a Server-Side Request Forgery (SSRF) was possible via the DevKit debug listener endpoint.
Original NVD description (English source)
In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session