Vulnerability in JetBrains Toolbox App

[ Why it matters ]Priority signals

• Critical severity: CVSS 9.0

[ Description ]Official description

In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand and Rider before 2026.3 and 2026.2.4; CLion before 2026.3 and 2026.2.4.1; DataGrip before 2026.3 and 2026.2.6.1; RustRover before 2026.3 and 2026.2.5, the jetbrainsd daemon trusted compromised intermediate certificates

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund1 Nov 2026WID-SEC-2026-4280

  JetBrains Toolbox App: Vulnerability allows bypassing security measures Translated from German

  CVE-2026-118697

[ References ]References

• blog.jetbrains.com/security/2026/10/compromised-emudhra-certificates-ides
• bugzilla.mozilla.org/show_bug.cgi
• emudhra.com/en/post/certificate-security-incident
• www.jetbrains.com/privacy-security/issues-fixed