CVE-2026-86502

Received Received - Intake

Remote Code Execution in JetBrains IntelliJ IDEA Remote Development

Publication date: 2026-09-07

Last updated on: 2026-09-09

Assigner: JetBrains s.r.o.

Description

In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-07

Last Modified

2026-09-09

Generated

2026-09-27

AI Q&A

2026-09-07

EPSS Evaluated

2026-09-26

NVD

CVE-2026-86502

EUVD

EUVD-2026-72518

Affected Vendors & Products

Vendor	Product	Version / Range
jetbrains	intellij_idea	to 2026.2.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability exists in JetBrains IntelliJ IDEA versions before 2026.2.2. It involves missing TLS encryption and authentication on the IJent gRPC server used for Remote Development. This flaw allows attackers with local access to execute arbitrary code on affected systems.

Detection Guidance

This vulnerability involves a missing TLS and authentication on the IJent gRPC server in JetBrains IntelliJ IDEA before 2026.2.2. Detection requires checking if the IJent gRPC server is running without TLS or authentication on Remote Development hosts. Verify the IntelliJ IDEA version and inspect network connections to the gRPC server port.

Impact Analysis

If exploited, this vulnerability could allow an attacker to run malicious code on your system, potentially leading to data theft, system compromise, or unauthorized access. It specifically affects Remote Development hosts using vulnerable IntelliJ IDEA versions.

Compliance Impact

This vulnerability allows local code execution on Remote Development hosts due to missing TLS and authentication on the IJent gRPC server. This could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) compliance by exposing personal or health-related information.

Mitigation Strategies

Update JetBrains IntelliJ IDEA to version 2026.2.2 or later to address the missing TLS and authentication issue in the IJent gRPC server.

Hi! I’m here to help you understand CVE-2026-86502. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70