JetBrains has issued security updates to remediate a critical code execution vulnerability affecting IntelliJ IDEA, along with four high-severity flaws in its TeamCity platform. The company is urging development teams and CI administrators to implement these patches without delay to mitigate the risk of remote attacks targeting their JetBrains critical vulnerabilities.
The software vendor published a security advisory on July 24, 2026, detailing multiple security issues across its integrated development environment and server products. The patches are incorporated into IntelliJ IDEA versions 2026.1.4 and 2026.2, as well as TeamCity versions 2026.1.2 and 2025.11.6. Organizations using these products should upgrade to these releases or later versions to fully address the identified security weaknesses.
What Critical Flaws Were Found in IntelliJ IDEA?
The most severe vulnerability in IntelliJ IDEA involves project workspace ID handling, designated as CVE-2026-59792. This flaw enables code execution through path traversal during workspace ID processing. JetBrains also addressed a high-risk command injection vulnerability in filename completion tracked as CVE-2026-49366, along with another high-risk command execution flaw affecting guest accounts identified as CVE-2026-49367. Both vulnerabilities allow attackers to execute arbitrary commands if they can manipulate project content or guest sessions.
The advisory further identifies several critical weaknesses in the remote development functionality. These include unauthorized input injection during Remote Development sessions (CVE-2026-64812) and unauthorized modification of settings (CVE-2026-64813). An additional high-severity issue, CVE-2026-64814, permitted unauthorized file access within the same Remote Development context, significantly increasing risk for teams exposing IDE backends over SSH or in shared environments.
Which TeamCity Vulnerabilities Were Patched?
JetBrains remediated four significant vulnerabilities in TeamCity, including a critical remote code execution flaw in Git VCS roots designated CVE-2026-65907. This vulnerability allows code execution through malicious repository configuration. Another high-severity issue, CVE-2026-65906, involves code execution via a Kotlin DSL sandbox escape in build configuration scripts.
Two additional vulnerabilities were addressed: CVE-2026-59793, which involves arbitrary file access in Perforce integration, and CVE-2026-59794, which addresses stored cross-site scripting in cloud profile data. The Git VCS roots vulnerability falls under CWE-94 (Code Injection), enabling attackers to achieve remote code execution through crafted Git root settings on vulnerable TeamCity servers.
What Actions Should Organizations Take?
For IntelliJ IDEA, the critical workspace ID path traversal issue has been resolved in versions 2026.1.4 and 2026.2. Users operating older 2026.1.x and 2025 branches remain vulnerable and must upgrade. TeamCity vulnerabilities CVE-2026-65906 and CVE-2026-65907 have been fixed in versions 2026.1.2 and 2025.11.6.
JetBrains recommends immediate upgrades to patched versions of both products. Organizations should review build configurations and VCS roots for untrusted or user-supplied scripts. Security-conscious teams should restrict who can define Kotlin DSL, Git, and Perforce roots, enforce project trust prompts, and monitor build logs for suspicious script execution or unexpected agent behavior.
Source: Cybersecurity News