CVE-2026-49367

Analyzed Analyzed - Analysis Complete

Command Execution via Guest Account in JetBrains IntelliJ IDEA

Publication date: 2026-05-29

Last updated on: 2026-06-01

Assigner: JetBrains s.r.o.

Description

In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-29

Last Modified

2026-06-01

Generated

2026-07-09

AI Q&A

2026-05-29

EPSS Evaluated

2026-07-08

NVD

CVE-2026-49367

EUVD

EUVD-2026-33415

Affected Vendors & Products

Vendor	Product	Version / Range
jetbrains	intellij_idea	to 2026.1.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Mitigation Strategies

To mitigate this vulnerability, update JetBrains IntelliJ IDEA to version 2026.1.1 or later, as the issue allowing command execution via the guest user account is fixed in that release.

Executive Summary

This vulnerability exists in JetBrains IntelliJ IDEA versions before 2026.1.1. It allows command execution through the guest user account, meaning that an attacker with access to the guest account could execute arbitrary commands on the affected system.

Impact Analysis

The vulnerability can have a severe impact as it allows an attacker to execute commands with high confidentiality, integrity, and availability impact. This means an attacker could potentially take control of the system, access sensitive data, modify or delete information, and disrupt system operations.

Hi! I’m here to help you understand CVE-2026-49367. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70