CVE-2026-86502
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
In JetBrains IntelliJ IDEA before 2026.2.2, missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts.
Risk Assessment
The risk is that an attacker can execute code locally in remote development environments, potentially leading to host takeover.
Recommendation
Update IntelliJ IDEA to 2026.2.2 or later. Also configure secure TLS and authentication for the gRPC server.
Other vulnerabilities in IntelliJ IDEA
See all- CVE-2026-64813Critical
In JetBrains IntelliJ IDEA before 2026.2, unauthorized settings modification was possible in a Remote Development session.
- CVE-2026-59792Critical
In JetBrains IntelliJ IDEA before 2026.1.4 and 2026.2, a vulnerability allowed code execution via path traversal in project workspace ID handling.
- CVE-2026-86504High
In JetBrains IntelliJ IDEA before 2026.2.2, missing project-trust confirmation before building a Dev Container allowed host-level code execution.
- CVE-2026-64814High
In IntelliJ IDEA before version 2026.2, there is a vulnerability allowing unauthorized file access during a Remote Development session. An attacker can access files they should not have permission to.
- CVE-2026-49383Low
In JetBrains IntelliJ IDEA before 2026.1, the UI Designer form parser is vulnerable to XXE (XML External Entity) attacks.
Original NVD description (English source)
In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts