JetBrains Patches Multiple Vulnerabilities Affecting IntelliJ IDEA and TeamCity

JetBrains has addressed a series of security vulnerabilities affecting IntelliJ IDEA and TeamCity, including several critical flaws that could allow code execution or unauthorized actions in development and continuous integration environments.

The updates fix weaknesses in Remote Development sessions, Git and Perforce VCS integrations, workspace handling, agent registration, and permission validation.

JetBrains Patches Multiple Vulnerabilities

Two critical vulnerabilities in IntelliJ IDEA impact Remote Development sessions in version 2026.22026.22026.2. The first, CVE-2026-64812 (tracked as IJPL-245951), could allow unauthorized input injection during a Remote Development session, as reported by JetBrains.

This issue is classified as CWE-306, which refers to the lack of authentication for critical functionality. An attacker who interacts with a vulnerable remote development workflow could potentially inject input without the necessary authorization controls, posing risks for developers working on sensitive repositories or systems.

The second critical issue, CVE-2026-64813 (IJPL-245849), may permit unauthorized modifications of settings in Remote Development sessions.

Classified as CWE-602, this flaw indicates insufficient server-side enforcement of client-side security controls. Unauthorized changes to project or IDE settings could undermine developer safeguards, alter execution behavior, or facilitate follow-on attacks in remote development environments.

JetBrains has also fixed CVE-2026-59792, a critical path traversal flaw in IntelliJ IDEA’s project workspace ID handling. Reported by Antoni Tremblay and tracked as IJPL-247564, this vulnerability could enable code execution through manipulated workspace identifiers.

It is categorized under CWE-23 and affects IntelliJ IDEA versions 2026.1.42026.1.42026.1.4 and 2026.22026.22026.2. Path traversal vulnerabilities are particularly concerning in development tools, as they can provide attackers with access to files outside their intended directory boundaries.

For TeamCity, the most severe finding is CVE-2026-65907, a critical code-execution vulnerability affecting Git VCS roots. Tracked as TW-101674 and classified as CWE-94, this flaw affects TeamCity versions 2026.1.22026.1.22026.1.2 and 2025.11.62025.11.62025.11.6.

Given that TeamCity often has access to source code, credentials, artifact repositories, and deployment infrastructure, code execution on a build server could have significant supply chain implications.

Additionally, TeamCity version 2026.1.22026.1.22026.1.2 resolves four high-severity issues. CVE-2026-59793, reported by @maple3142, could allow arbitrary file access through the Perforce VCS integration due to external control of file names or paths (classified as CWE-73).

CVE-2026-59794 addresses stored cross-site scripting (XSS) on the cloud profile page through agent-reported data, while CVE-2026-59795 fixes stored XSS vulnerabilities via unauthenticated agent registration.

Both issues are classified as CWE-79 and could expose administrator sessions or enable malicious actions through the TeamCity web interface.

The final high-severity flaw, CVE-2026-59796, impacts TeamCity permission checks and could permit unauthorized modification of pipelines.

Reported by Alwion and tracked as TW-101629, this CWE-862 issue could allow an attacker to alter build configurations or delivery workflows if they gain access to an insufficiently restricted account.

Administrators are advised to upgrade IntelliJ IDEA and TeamCity to the latest fixed releases immediately. They should also restrict Remote Development exposure, review TeamCity agent-registration settings, rotate potentially exposed credentials, and audit build configuration changes for signs of unauthorized activity.

ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.