Zero Radar
← feed
CriticalVulnerabilityCVE-2026-118697updated 30 Oct 2026, 18:19 UTC

JetBrains Toolbox and IntelliJ IDEA trust forged certificates

A background helper in JetBrains software could be tricked into trusting fake security certificates. This could let an attacker pose as a trusted JetBrains server and send harmful updates or data.

Fix available · out Official source
SeverityCriticalCVSS 9 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesJetBrains Toolbox App 3.9.1 or 3.8.2; IntelliJ IDEA 2026.3 or 2026.2.4 (or later) · since 30 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Attacker forges certificateUses compromised intermediate certificate
  2. 2Traffic redirectedAttacker sits between tool and server
  3. 3jetbrainsd trusts itDaemon accepts the fake certificate
  4. 4Malicious content acceptedTool receives attacker-controlled data
  5. ResultAttacker impersonates JetBrains services

What happened

The jetbrainsd daemon in JetBrains Toolbox App and IntelliJ IDEA accepted compromised intermediate certificates, weakening the verification of server identity.

Why it is dangerous: An attacker able to present trusted-looking certificates could intercept or impersonate JetBrains services, potentially delivering malicious content to developers' machines. Developers and organisations using these tools are at risk.

Are you affected?

You are affected if you run JetBrains Toolbox App before 3.9.1 or 3.8.2, or IntelliJ IDEA before 2026.3 or 2026.2.4.

JetBrains Toolbox App before 3.9.1 and before 3.8.2; IntelliJ IDEA before 2026.3 and before 2026.2.4

What to do

  1. Update JetBrains Toolbox App to 3.9.1 or 3.8.2 or later
  2. Update IntelliJ IDEA to 2026.3 or 2026.2.4 or later
  3. Check that jetbrainsd and Toolbox are running only the patched versions on all developer machines

Timeline

  1. 30 Oct 2026, 18:17 UTC
    Publicly disclosed
  2. 30 Oct 2026, 18:17 UTC
    Reported by NVD · NVD
  3. 30 Oct 2026, 18:19 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-118697
CVSS
9 / 10
Disclosed
30 Oct 2026, 18:17 UTC
On Zero Radar
30 Oct 2026, 18:19 UTC (2 min after disclosure)
Last change
30 Oct 2026, 18:19 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

JetBrains Toolbox and IntelliJ IDEA trust forged certificates · Zero Radar