CVE-2026-118697criticalCWE-295

CVE-2026-118697: critical vulnerability in JetBrains Toolbox App

Published 30 Oct 2026 · Updated 02 Nov 2026

Follow this CVE + Monitor IntelliJ IDEA + Monitor PyCharm

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9epss 0.3%

In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand and Rider before 2026.3 and 2026.2.4; CLion before 2026.3 and 2026.2.4.1; DataGrip before 2026.3 and 2026.2.6.1; RustRover before 2026.3 and 2026.2.5, the jetbrainsd daemon trusted compromised intermediate certificates

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

JetBrains · CLion JetBrains · DataGrip JetBrains · GoLand JetBrains · IntelliJ IDEA JetBrains · PhpStorm JetBrains · PyCharm JetBrains · Rider JetBrains · RubyMine JetBrains · RustRover JetBrains · Toolbox App JetBrains · WebStorm

Related CVEs — JetBrains Toolbox App

In the same product, most dangerous first.

CVE-2024-37051CRITICALCVE-2024-37051EPSS 4.9%CVE-2026-64800LOWCVE-2026-64800EPSS 0.8%CVE-2026-53915HIGHCVE-2026-53915EPSS 0.5%CVE-2026-86506MEDIUMCVE-2026-86506EPSS 0.4%CVE-2026-118696HIGHCVE-2026-118696EPSS 0.3%CVE-2026-64803HIGHCVE-2026-64803EPSS 0.2%

References

https://blog.jetbrains.com/security/2026/10/compromised-emudhra-certificates-ides/https://bugzilla.mozilla.org/show_bug.cgi?id=2083449 https://emudhra.com/en/post/certificate-security-incident https://www.jetbrains.com/privacy-security/issues-fixed/