JetBrains Patches Critical Flaws in IDEs and Background Services After Certificate Breach

TL;DR

JetBrains released urgent security updates on October 30, 2026, addressing critical JetBrains IDE vulnerabilities caused by compromised digital certificates. The flaws stem from trusted intermediate certificate authorities that attackers could abuse to conduct man-in-the-middle attacks against developers. Software engineers must update their IDEs, JetBrains Runtime, and background services immediately to prevent traffic interception.

Why It Matters

JetBrains provides development software to more than 16 million developers worldwide, according to company estimates. Software engineers use these integrated development environments (IDEs) to build, test, and deploy critical enterprise applications. Consequently, intercepting developer traffic poses a severe software supply chain threat.

In October 2026, a major security breach struck the certificate authority eMudhra. According to the official JetBrains security update bulletin, “The private keys of eight eMudhra intermediate certificates were compromised.” Attackers holding these private keys can forge valid Transport Layer Security (TLS) certificates for arbitrary internet domains. Leaving these JetBrains IDE vulnerabilities unpatched allows attackers to mount man-in-the-middle attacks against developer workstations. However, in the advisory, JetBrains confirmed: “At the time of publishing, we are not aware of any exploitation of this issue against JetBrains users.” Furthermore, researchers have not published any public proof-of-concept exploit code for these issues.

How the Attack Works

The vulnerabilities allow network adversaries to impersonate secure endpoints without raising standard operating system warnings.

Compromised Intermediate Certificates and JBR Trust Store

During normal development workflows, IDEs connect to cloud repositories, plugin marketplaces, and licensing servers. The advisory warns that “A network attacker could use them to impersonate websites and services that JetBrains tools connect to.” If an attacker intercepts network traffic, they can present a fraudulent certificate signed by the compromised eMudhra intermediates.

Standard operating system patch management cannot resolve this issue on developer workstations. The vendor explains that “JetBrains IDEs check certificates against the trust store of their bundled runtime, JetBrains Runtime (JBR), so updating your operating system doesn’t protect against this issue.” To block fraudulent connections, JetBrains integrated Oracle fixes for CVE-2026-91403 and CVE-2026-114820 into JBR. This update removes trust for four root certificates: emSign ECC Root CA – G3, emSign Root CA – G1, emSign Root CA – G2, and AAA Certificate Services.

Embedded Browser and Background Daemon Vulnerabilities

Beyond the runtime trust store, two specific vulnerabilities weaken desktop environments. Tracked as CVE-2026-118696 with an 8.0 CVSS score, the embedded Chromium-based browser (JCEF) inside IntelliJ-based IDEs trusted revoked intermediate certificates. When developers view documentation or web previews within the IDE, the unpatched browser accepts revoked certificates until Google’s update mechanism refreshes the blocklist.

Additionally, CVE-2026-118697 represents a critical flaw with a 9.0 CVSS rating in the jetbrainsd background service. This daemon runs alongside the Toolbox App and desktop IDEs to handle local background tasks. Because jetbrainsd maintains its own internal list of trusted certificates independent of JBR, it continued to trust the compromised keys. An attacker intercepting daemon communications could spoof backend services or manipulate software installations.

Affected Versions

These JetBrains IDE vulnerabilities affect the entire family of desktop IDEs, including IntelliJ IDEA, PyCharm, WebStorm, PhpStorm, CLion, Rider, GoLand, RubyMine, DataGrip, RustRover, and DataSpell. Specifically, versions prior to 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2 contain the vulnerable trust stores. Furthermore, the Toolbox App before versions 3.9.1 and 3.8.2, JetBrains Gateway, and ReSharper are affected. Legacy IDE releases from version 2025.1 and earlier will not receive patches.

Patch and Mitigation Steps

Developers must upgrade to the latest bugfix releases listed in the JetBrains fixed issues portal immediately. Patched versions include IntelliJ IDEA 2026.2.4, Toolbox App 3.9.1, and jetbrainsd version 0.9.9728. Updating the Toolbox App automatically updates the jetbrainsd daemon for all installed IDEs.

If developers cannot upgrade immediately, they should disable JCEF in their IDE settings and update the jetbrainsd daemon manually. Furthermore, organizations should inspect custom project JDKs and external tool runtimes, such as Node.js or Python, to ensure their certificate stores do not trust the revoked eMudhra roots.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.