JetBrains patches IDE flaws linked to eMudhra certificate breach

JetBrains has issued urgent security updates on 30 October 2026 after a breach at certificate authority eMudhra left eight intermediate certificates compromised. The flaws, tracked as CVE-2026-118697 (CVSS 9.0) and CVE-2026-118696 (CVSS 8.0), stem from trusted intermediate certificates that attackers could misuse to impersonate sites and services JetBrains tools connect to. JetBrains confirms there was no known exploitation at the time of publishing, and says patches are available.

The advisory states that the issues affect the entire family of desktop IDEs and related tooling, including Toolbox App and several IDEs, with legacy releases prior to patch availability not receiving fixes.

The two vulnerabilities operate by enabling attackers to perform man-in-the-middle attacks against developer workstations. In particular, the embedded Chromium-based browser component (JCEF) inside IntelliJ-based IDEs can trust revoked certificates until blocklists refresh, while the jetbrainsd background daemon maintains its own trust store and could be misled to interact with malicious services.

JetBrains notes that fixes have been integrated into JetBrains Runtime (JBR) to block the revoked certificates, and patches specifically address CVE-2026-91403 and CVE-2026-114820 within JBR. Affected versions include IntelliJ IDEA before 2026.3 and 2026.2.4, Toolbox App before 3.9.1 and 3.8.2, and related components such as JetBrains Gateway and ReSharper.

Patched releases include IntelliJ IDEA 2026.2.4, Toolbox App 3.9.1, and jetbrainsd 0.9.9728; updating the Toolbox App will automatically update the jetbrainsd daemon.