JetBrains: 18 Vulnerabilities Across IDEs and YouTrack Disclosed Together
Key findings • 18 vulnerabilities disclosed across JetBrains PyCharm, IntelliJ IDEA, YouTrack, and Ktor on August 17, 2026. • Critical vulnerability (CVE-2026-75045) allows unauthenticated da…
Key findings
- 18 vulnerabilities disclosed across JetBrains PyCharm, IntelliJ IDEA, YouTrack, and Ktor on August 17, 2026.
- Critical vulnerability (CVE-2026-75045) allows unauthenticated database backup downloads in YouTrack.
- Multiple code execution and SSRF vulnerabilities found in IntelliJ IDEA and PyCharm.
- YouTrack affected by stored XSS, unauthorized data access, and DoS vulnerabilities.
- Patches are available for all disclosed vulnerabilities, with specific version updates provided.
On August 17, 2026, a significant batch of 18 vulnerabilities was disclosed across multiple JetBrains products, including IntelliJ IDEA, PyCharm, YouTrack, and Ktor. These vulnerabilities, disclosed on the same day, range in severity from Low to Critical, with several High and Medium-severity flaws impacting core functionalities. The disclosures highlight potential risks including code execution, unauthorized data access, denial of service, and cross-site scripting (XSS).
Several vulnerabilities in IntelliJ IDEA and PyCharm revolve around code execution and data exposure. CVE-2026-75060, a High severity vulnerability in PyCharm, allowed for unauthenticated code execution via Jupyter MCP tools. Similarly, CVE-2026-75059, also in PyCharm, permitted code execution through Quick Documentation. For IntelliJ IDEA, CVE-2026-75056 (High) enabled remote code execution via the Markdown export tool, while CVE-2026-75054 (Medium) and CVE-2026-75053 (Medium) involved Server-Side Request Forgery (SSRF) through different mechanisms. Additionally, CVE-2026-75057 (Medium) saw git credentials exposed in plaintext logs, and CVE-2026-75055 (Medium) allowed the Hadoop ResourceManager to read local files via XXE. CVE-2026-75052 (Low) presented a code execution risk via crafted Markdown in trusted projects. CVE-2026-75058 (Medium) involved XXE in Eclipse settings importers.
The YouTrack product was also significantly impacted, with vulnerabilities affecting authentication, authorization, and data integrity. CVE-2026-75045, a Critical severity flaw, allowed unauthenticated attackers to download database backups via shared draft signatures. CVE-2026-75051 (High) in YouTrack permitted unauthorized project transfers between organizations. CVE-2026-75048 (High) enabled stored XSS via the fenced code-block language label. CVE-2026-75044 (High) involved missing authorization, allowing authenticated users to delete arbitrary entities. Other YouTrack vulnerabilities include CVE-2026-75049 (Medium) for reading restricted articles, CVE-2026-75047 (Medium) for denial of service via decompression bombs, and CVE-2026-75046 (Medium) for account enumeration.
JetBrains Ktor also had a disclosed vulnerability, CVE-2026-68762 (Medium), which could lead to a denial of service attack via WebSocket decompression.
The affected versions and patches vary across the products. For PyCharm, versions before 2026.2.1 are impacted by CVE-2026-75060 and CVE-2026-75059. IntelliJ IDEA versions before 2026.2.1 are affected by CVE-2026-75058, CVE-2026-75056, CVE-2026-75054, and CVE-2026-75053. CVE-2026-75057 was fixed in IntelliJ IDEA before 2026.1.5, and CVE-2026-75055 in versions before 2026.2.1. CVE-2026-75052 was patched in IntelliJ IDEA before 2026.2.1. YouTrack vulnerabilities were addressed in various versions: CVE-2026-75051 in 2026.2.17917, CVE-2026-75050 in 2026.1.13901 and 2026.2.17950, CVE-2026-75049 in 2026.1.13903 and 2026.2.17950, CVE-2026-75048 in 2026.2.18068, CVE-2026-75047 in 2026.2.18177, CVE-2026-75046 in 2026.2.18112, CVE-2026-75045 in 2025.3.156085, 2026.1.13913, and 2026.2.18112, and CVE-2026-75044 in 2025.3.156085, 2026.1.13914, and 2026.2.18095. Ktor versions before 3.4.1 are affected by CVE-2026-68762. Users are strongly advised to update to the patched versions to mitigate these security risks.
This coordinated disclosure highlights the importance of timely patching for JetBrains products. The range of vulnerabilities, from critical data exfiltration to code execution and denial of service, underscores the need for users to review and apply the available updates promptly. Staying informed about security advisories and maintaining updated software are crucial steps in defending against potential exploits targeting these development tools and platforms.