In JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be added to the trust store during headless runs
IntelliJ IDEA installations before 2026.3 are affected when they perform headless runs. The provided information does not establish whether interactive, non-headless use is affected.
The CVSS vector indicates network access is required, while no privileges or user interaction are required. Exploitation has high attack complexity.
The vulnerability is rated high severity with high confidentiality and integrity impact. No availability impact is indicated.
Identify IntelliJ IDEA installations running versions before 2026.3 and determine whether they execute headless runs. Those systems should be treated as potentially affected.
Update IntelliJ IDEA to version 2026.3 or later. The issue is described as affecting versions before 2026.3.