---
title: "CVE-2026-118696: JetBrains Products - Misconfiguration"
description: "JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand, Rider, CLion, DataGrip, RustRover, and DataSpell before specified versions contain a certificate validation issue caused by trusted revoked intermediate certificates in the embedded browser, letting attackers potentially bypass trust validation, exploit requires use of embedded browser."
url: https://panop.io/threat-heartbeat/CVE-2026-118696/
---

# CVE-2026-118696 JetBrains Products - Misconfiguration

JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand, Rider, CLion, DataGrip, RustRover, and DataSpell before specified versions contain a certificate validation issue caused by trusted revoked intermediate certificates in the embedded browser, letting attackers potentially bypass trust validation, exploit requires use of embedded browser.

CVSS base score 8.0 /10

High

CISA KEV

Not listed

Public exploit

None known

Authentication

Not required

EPSS

0.27% chance of exploitation in 30 days

[View the NVD record ↗](https://nvd.nist.gov/vuln/detail/CVE-2026-118696)

## Details

Type

Misconfiguration

Impact

Man In The Middle

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Published

30 October 2026

Updated

1 November 2026

Weakness

[CWE-299](https://cwe.mitre.org/data/definitions/299.html)

## References

- [https://nvd.nist.gov/vuln/detail/CVE-2026-118696](https://nvd.nist.gov/vuln/detail/CVE-2026-118696)
- [https://blog.jetbrains.com/security/2026/10/compromised-emudhra-certificates-ides/](https://blog.jetbrains.com/security/2026/10/compromised-emudhra-certificates-ides/)
- [https://bugzilla.mozilla.org/show\_bug.cgi?id=2083449](https://bugzilla.mozilla.org/show_bug.cgi?id=2083449)
- [https://emudhra.com/en/post/certificate-security-incident](https://emudhra.com/en/post/certificate-security-incident)
- [https://www.jetbrains.com/privacy-security/issues-fixed/](https://www.jetbrains.com/privacy-security/issues-fixed/)

[← All CVEs](https://panop.io/threat-heartbeat/)

## What this record can't tell you

- Whether you run the affected software, and where
- Whether an attacker can actually reach and exploit it
- The misconfigurations that never get a CVE number
- What it would cost the business, ranked into what to fix first

Panop answers these inside your environment, for this CVE and every other finding.

[Book a demo](https://panop.io/demo)