CVE-2026-86502: High severity JetBrains IntelliJ IDEA vulnerability
In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed?
Remote Development hosts running JetBrains IntelliJ IDEA versions before 2026.2.2 are affected. The issue is on the IJent gRPC server used by Remote Development hosts.
What access does an attacker need?
The vulnerability has a local attack vector and requires no privileges or user interaction. An attacker able to execute or run code locally on the affected Remote Development host could exploit the exposed IJent gRPC server.
What is the impact of successful exploitation?
Successful exploitation allows local code execution on the Remote Development host. The reported severity vector indicates high confidentiality, integrity, and availability impact.
How can I remediate this issue?
Update JetBrains IntelliJ IDEA to version 2026.2.2 or later. The provided information does not identify a workaround for hosts that cannot be updated immediately.