SB2026081799 - Multiple vulnerabilities in IntelliJ IDEA

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026081799

SB2026081799 - Multiple vulnerabilities in IntelliJ IDEA

Published: August 17, 2026

Security Bulletin ID SB2026081799
CSH Severity
High
Patch available
YES
Number of vulnerabilities 7
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 29% Medium 43% Low 29%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 7 vulnerabilities.


1) Path traversal (CVE-ID: CVE-2026-59792)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to path traversal in project workspace ID handling when processing a crafted project workspace identifier. A remote attacker can supply a crafted project workspace identifier to execute arbitrary code.


2) Cross-site scripting (CVE-ID: CVE-2026-64810)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to track user activity silently.

The vulnerability exists due to cross-site scripting in an IDE notification when rendering notification content. A remote attacker can inject crafted HTML content to track user activity silently.


3) Inclusion of Functionality from Untrusted Control Sphere (CVE-ID: CVE-2026-64811)

CWE-ID: CWE-829 - Inclusion of Functionality from Untrusted Control Sphere

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to inclusion of functionality from untrusted control sphere in development container configuration when processing a project before trust is granted. A remote attacker can supply a specially crafted development container configuration to execute arbitrary code.

User interaction is required to open a project containing the crafted configuration.


4) Missing Authentication for Critical Function (CVE-ID: CVE-2026-64812)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to inject unauthorized input.

The vulnerability exists due to improper authentication in Remote Development session handling when processing Remote Development session input. A remote attacker can send crafted input to inject unauthorized input.


5) Client-Side Enforcement of Server-Side Security (CVE-ID: CVE-2026-64813)

CWE-ID: CWE-602 - Client-Side Enforcement of Server-Side Security

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify settings without authorization.

The vulnerability exists due to improper access control in Remote Development session settings handling when processing Remote Development session operations. A remote user can modify settings in a Remote Development session to modify settings without authorization.


6) Missing Authorization (CVE-ID: CVE-2026-64814)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to access unauthorized files.

The vulnerability exists due to improper authorization in remote development session file access handling when accessing files during a remote development session. A remote user can access files without proper authorization to access unauthorized files.


7) Code Injection (CVE-ID: CVE-2026-64815)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to code injection in UI Designer form file processing when parsing a crafted form file. A remote user can supply a specially crafted form file to execute arbitrary code.

User interaction is required to open or import the crafted form file.


Remediation

Install update from vendor's website.

References