JetBrains IntelliJ IDEA multiple flaws allow code execution
The IntelliJ IDEA coding tool can let attackers take over your PC.
Summary
Before 2026.3, JetBrains IntelliJ IDEA lets an unauthenticated remote attacker run code through an exposed database-worker address. Opening untrusted projects also exposes other flaws that run code or write files.
Affected when
- Opening untrusted projects
- Using Remote Development
- Headless runs
What to do
Check that IntelliJ IDEA is version 2026.3 or newer, and update it if not. Read the JetBrains advisory for details.
Products and platforms
CVE IDs
- CVE-2026-123278 (opens in a new tab)
- CVE-2026-123301 (opens in a new tab)
- CVE-2026-123304 (opens in a new tab)
- CVE-2026-123305 (opens in a new tab)
- CVE-2026-123306 (opens in a new tab)
- CVE-2026-123308 (opens in a new tab)
- CVE-2026-123310 (opens in a new tab)
- CVE-2026-123313 (opens in a new tab)
- CVE-2026-123833 (opens in a new tab)
- CVE-2026-123838 (opens in a new tab)
- CVE-2026-123839 (opens in a new tab)
- CVE-2026-123840 (opens in a new tab)
- CVE-2026-123841 (opens in a new tab)
- CVE-2026-123842 (opens in a new tab)
- CVE-2026-123843 (opens in a new tab)
- CVE-2026-123844 (opens in a new tab)
- CVE-2026-123845 (opens in a new tab)
- CVE-2026-123846 (opens in a new tab)
- CVE-2026-123847 (opens in a new tab)
- CVE-2026-123848 (opens in a new tab)
- CVE-2026-123849 (opens in a new tab)
Sources
- CVE record: cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab)
Times
First published
First seen