IntelliJ IDEA: 10.0 Remote Development hijack flaws (CVE-2026-64812) — update to 2026.2

"IntelliJ IDEA," the integrated development environment (an all-in-one app for writing programs) used by developers worldwide, has several newly disclosed flaws — including ones rated the worst possible 10.0 out of 10. The most serious involve "Remote Development," where the IDE runs on a distant server that you operate from your own machine: three flaws (CVE-2026-64812 and others) let an attacker break into an in-progress session with no password, inject commands, or rewrite its settings.

The maker, Czech company JetBrains, has fixed them in 2026.2. This article also covers an earlier flaw where simply opening a crafted project runs code (CVE-2026-59792, severity 9.6). Updating IntelliJ IDEA to the latest version stops both. First, check whether you "use Remote Development" and whether you are "running an old version."

What IntelliJ IDEA is, and what Remote Development is

IntelliJ IDEA is an integrated development environment (IDE) built by Czech company JetBrains. An IDE bundles writing, running, and debugging code into a single screen. It is effectively the standard for Java and Kotlin development, and millions of developers worldwide use it daily, from enterprise systems to personal apps. It comes in a free Community edition and a paid Ultimate edition and is widely used in Japan too.

The biggest problem this time is a mode of use called "Remote Development." Here your own machine holds only a lightweight client, while the IntelliJ IDEA backend runs on a distant server or in the cloud, which you connect to and develop against. It is spreading in enterprises and cloud development to offload large projects to powerful servers and to standardize environments across a team. The flaws lie in the design of that "pipe between your machine and the distant server."

Dev tools routinely open projects received from outside (someone else's source code) and connect to distant servers. That very act of "connecting and opening" can become the entry point for an attack — the scary part of IDEs. The same pattern keeps appearing in dev tools, as with the flaw in VS Code's Java extension and the flaw in Amazon's AI dev tool Kiro.

[Most important] Three flaws that hijack the Remote Development connection

The three newly disclosed flaws all concern the Remote Development session (the communication that links your machine to the server-side IDE). The common problem is that the connection did not sufficiently verify whether the party connecting was genuinely who they claimed to be. As a result, a third party within reach of the session can break in with no password and no user action. The top two are rated the worst possible 10.0 — over the network, no authentication, no user interaction (AV:N/PR:N/UI:N).

CVE-2026-64812: inject commands into a session with no authentication (10.0)

This flaw lets an attacker send unauthorized input into a Remote Development session without the authentication that should be required. NIST classifies it as "missing authentication for a critical function (CWE-306)." By exploiting it, an attacker can run unintended processing on the server side through the dev session, effectively taking control of that remote environment. It scores a perfect 10.0, with a "scope change (S:C)" — impact spilling beyond the software itself — and confidentiality, integrity, and availability all rated High.

CVE-2026-64813: rewrite the session's settings at will (10.0)

This flaw lets an attacker improperly change the settings of a Remote Development session. The cause is a design that left security decisions — which the server should enforce — up to the connecting client (CWE-602). Rewriting the settings lets an attacker bend the session's behavior to their advantage and use it as a foothold for deeper compromise. Like 64812, it is rated the worst possible 10.0.

CVE-2026-64814: read files improperly through the session (8.6)

This flaw lets an attacker read files they should not have access to through a Remote Development session. The cause is missing authorization (CWE-862), and because the impact is limited to information disclosure (confidentiality), its 8.6 is the lowest of the three. Even so, dev servers often hold other people's source code, settings, and credentials, and being able to peek at those is not something to shrug off.

All three are fixed in 2026.2, and JetBrains discloses them on its list of fixed security issues. Environments using Remote Development should update to 2026.2 or later as the top priority.

Who the attacker targets, and what they do

The likely abusers of the three Remote Development flaws are attackers positioned where traffic reaches a dev server or cloud environment, trying to hijack someone else's dev session running there. Think of an insider threat already inside the corporate network, another tenant sharing a common cloud dev platform, or an attacker who finds a poorly protected dev server exposed from outside. Dev servers often hold production keys and source code, making them high-value targets.

What that attacker does is break into the dev session without authentication, inject commands, rewrite settings, or peek at the files sitting there, seizing the Remote Development environment from the inside. Once they hold the session, they can siphon off the source code and credentials there and use that environment as a springboard into other internal systems.

The damage does not stop at one machine. If a server a dev team shares is taken over, the whole team's work and keys are endangered at once. "Supply-chain attacks" that break into organizations through developers and dev platforms are on the rise, overlapping with the way attackers are accelerating attacks with AI. That is why the next section — sorting out which situation you are in — matters.

Which situation are you in — sort it into two tracks

These IntelliJ IDEA flaws split into two tracks with different entry points. Which one you fall into changes the severity and priority.

• You use Remote Development — if you run the IntelliJ IDEA backend on a server or in the cloud and connect from your machine, you are in scope for the three flaws (64812/64813/64814) that let attackers break in without authentication. This includes 10.0-rated flaws and needs top priority.
• You use it locally and sometimes open external projects — if everything runs on your own machine, you are unlikely to be directly hit by the three Remote Development flaws, but you are in scope for CVE-2026-59792 (9.6), where opening a malicious project is dangerous.
• Both apply — if you use Remote Development and also open external code, you are in scope for both tracks. Either way, updating to 2026.2 closes both at once.

The common thread: updating to 2026.2 or later resolves all four. If you are unsure of your version, follow the check steps in the sections below.

The other flaw — opening a crafted project runs code (CVE-2026-59792)

Separate from the three Remote Development flaws, the earlier CVE-2026-59792 (severity 9.6) is a flaw where the moment a user opens an attacker-prepared project (a set of source code) in their own IntelliJ IDEA, code runs on their machine. For developers who work locally, this is the main concern.

CVE-2026-59792: the workspace-ID handling lets an executable be planted

When IntelliJ IDEA opens a project, it reads and writes settings files based on an identifier for the project's working location (the workspace ID). That identifier was supposed to point only inside a designated folder. But if a value is laced with "../"-style symbols that move up to parent folders, files can be written outside the designated range. NIST classifies this as relative-path directory traversal (CWE-23, so-called path traversal).

The technique: an attacker prepares a project with a tampered workspace ID, and when the victim opens it, a file containing the attacker's code is written to a location IntelliJ IDEA loads automatically, such as at startup, and runs. No login is required, but the victim opening the project is the trigger. Opening code handed over disguised as a handy library, an interview assignment, or a work handoff, without suspicion, puts you at risk. As with the flaw in the AI coding tool Cline where merely opening a malicious site let attackers control the PC, the developer's everyday act of "opening" is the trigger. This flaw is resolved in 2026.1.4 and 2026.2.

Affected versions and remediation

The three Remote Development flaws (64812/64813/64814) affect all versions before 2026.2 and are fixed in 2026.2. The project-opening flaw CVE-2026-59792 affects versions before 2026.1.4 and before 2026.2 and is fixed in 2026.1.4 or 2026.2. Either way, updating to 2026.2 or later closes all four. Apply the latest version from the IDE's "Check for Updates."

As a stopgap when you cannot update immediately, it helps to confine the Remote Development connection path to your internal network (so it cannot be reached from outside) and to not open projects of unknown origin. IntelliJ IDEA also has a "safe mode" that opens untrusted projects with restrictions. But these only buy time; the real fix is updating to the latest version.

What is confirmed, and what is not

What you can do right now

The core response is clear: update IntelliJ IDEA to 2026.2 or later as the top priority. From the IDE's "Help" menu, run "Check for Updates" and apply the latest version. If you manage several IDEs together with JetBrains' "Toolbox App," update from Toolbox. Environments using Remote Development especially should not be left alone, since they carry 10.0 holes that allow takeover without authentication.

If you use Remote Development, reviewing the connection path also helps. Confine connections to dev servers to the inside of your internal network or VPN so they cannot be reached directly from the internet, and you cut the risk of outside break-ins. If you work locally, the habit of not carelessly opening projects or sample code of unknown origin matters. Dev tools keep suffering incidents where the "connect / open" action is abused, as with flaws in extensions and preview features and flaws where merely entering a project runs commands.

Frequently asked questions

Summary

This is a case where IntelliJ IDEA, a standard dev tool used by developers worldwide, was found to have several flaws including a worst-possible 10.0. The most serious are three in "Remote Development," where the IDE runs on a distant server: an attacker can break into a session without authentication to send commands, change settings, and read files. There is also CVE-2026-59792, where simply opening a crafted project runs code. Because developers' machines and dev platforms often hold an organization's keys, the damage does not stay with one person.

The relief is that JetBrains has already released fixes. Updating to 2026.2 or later stops all four. Treat dev tools on the assumption that the everyday act of "connecting and opening" is a target: update often, review Remote Development connection paths, and build the habit of not casually opening code of unknown origin. If new exploitation emerges, we will report again.

References

• ▸ NVD - CVE-2026-64812 (Remote Development, unauthenticated input)
• ▸ NVD - CVE-2026-64813 (Remote Development, unauthorized settings change)
• ▸ NVD - CVE-2026-64814 (Remote Development, improper file access)
• ▸ NVD - CVE-2026-59792 (code execution from a crafted project)
• ▸ JetBrains - Fixed security issues
• ▸ IntelliJ IDEA official site