{"id":"CVE-2026-118697","aliases":["EUVD-2026-114245","GHSA-c9gr-394r-65gg"],"status":"published","title":"In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA before 2026.3 and 2026.2.4, the...","description":"In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand and Rider before 2026.3 and 2026.2.4; CLion before 2026.3 and 2026.2.4.1; DataGrip before 2026.3 and 2026.2.6.1; RustRover before 2026.3 and 2026.2.5, the jetbrainsd daemon trusted compromised intermediate certificates","severity":{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00291,"percentile":0.21833,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-295"],"published":"2026-10-30T17:31:26Z","modified":"2026-11-02T17:17:39Z","products":[{"vendor":"jetbrains","product":"clion"},{"vendor":"jetbrains","product":"datagrip"},{"vendor":"jetbrains","product":"goland"},{"vendor":"jetbrains","product":"intellij idea"},{"vendor":"jetbrains","product":"phpstorm"},{"vendor":"jetbrains","product":"pycharm"},{"vendor":"jetbrains","product":"rider"},{"vendor":"jetbrains","product":"rubymine"},{"vendor":"jetbrains","product":"rustrover"},{"vendor":"jetbrains","product":"toolbox app"},{"vendor":"jetbrains","product":"webstorm"}],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/"},{"url":"https://blog.jetbrains.com/security/2026/10/compromised-emudhra-certificates-ides/"},{"url":"https://emudhra.com/en/post/certificate-security-incident"},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2083449"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118697"},{"url":"https://blog.jetbrains.com/security/2026/10/compromised-emudhra-certificates-ides"},{"url":"https://www.jetbrains.com/privacy-security/issues-fixed"},{"url":"https://github.com/advisories/GHSA-c9gr-394r-65gg"}],"sources":{"cve":[{"id":"CVE-2026-118697","description":"In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand and Rider before 2026.3 and 2026.2.4; CLion before 2026.3 and 2026.2.4.1; DataGrip before 2026.3 and 2026.2.6.1; RustRover before 2026.3 and 2026.2.5, the jetbrainsd daemon trusted compromised intermediate certificates","status":"published","published":"2026-10-30T17:31:26.886Z","modified":"2026-11-02T16:19:28.345Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T18:00:08.034842Z"}],"euvd":[{"id":"EUVD-2026-114245","description":"In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand and Rider before 2026.3 and 2026.2.4; CLion before 2026.3 and 2026.2.4.1; DataGrip before 2026.3 and 2026.2.6.1; RustRover before 2026.3 and 2026.2.5, the jetbrainsd daemon trusted compromised intermediate certificates","status":"published","published":"2026-10-30T17:31:26Z","modified":"2026-11-02T16:19:28Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T05:08:40.251173Z"}],"ghsa":[{"id":"GHSA-c9gr-394r-65gg","title":"In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA before 2026.3 and 2026.2.4, the...","description":"In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA before 2026.3 and 2026.2.4, the jetbrainsd daemon trusted compromised intermediate certificates","status":"published","published":"2026-10-30T18:32:44Z","modified":"2026-10-30T18:32:53Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:14:52.01816Z"}],"nvd":[{"id":"CVE-2026-118697","description":"In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand and Rider before 2026.3 and 2026.2.4; CLion before 2026.3 and 2026.2.4.1; DataGrip before 2026.3 and 2026.2.6.1; RustRover before 2026.3 and 2026.2.5, the jetbrainsd daemon trusted compromised intermediate certificates","status":"published","published":"2026-10-30T18:17:24.687Z","modified":"2026-11-02T17:17:39.1Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T20:51:43.99917Z"}]}}