JetBrains Patches Critical IntelliJ IDEA RCE and Four TeamCity Flaws

Key Takeaways

• JetBrains has released urgent security updates for critical vulnerabilities in its IntelliJ IDEA IDE and TeamCity CI/CD server.
• The flaws include multiple remote code execution (RCE) vulnerabilities, path traversal, command injection, and unauthorized access issues.
• Affected products are IntelliJ IDEA and TeamCity, impacting development teams and CI administrators.
• Patches are available in IntelliJ IDEA versions 2026.1.4 and 2026.2, and TeamCity versions 2026.1.2 and 2025.11.6.
• Immediate upgrades are strongly recommended to mitigate potential remote attacks.

JetBrains has issued a critical security advisory, urging users of its popular IntelliJ IDEA integrated development environment and TeamCity continuous integration/continuous delivery server to apply immediate patches. The updates address a range of severe vulnerabilities, including multiple critical remote code execution (RCE) flaws, which could allow attackers to compromise development workflows and build infrastructure.

Development teams and CI administrators are advised to prioritize these updates to protect against potential remote attacks. The comprehensive advisory details numerous issues across JetBrains’ product line, with several vulnerabilities classified as critical or high severity.

The necessary fixes are incorporated into IntelliJ IDEA versions 2026.1.4 and 2026.2, and TeamCity versions 2026.1.2 and 2025.11.6. Users must upgrade to these specific versions or later releases to ensure complete protection against the identified security weaknesses.

IntelliJ IDEA Vulnerabilities

A standout critical vulnerability in IntelliJ IDEA, identified as CVE-2026-59792, pertains to how the IDE handles project workspace IDs. This flaw enables code execution through a path traversal vulnerability during the processing of workspace IDs, potentially allowing an attacker to execute arbitrary code on the developer’s machine.

Beyond this critical issue, JetBrains has also patched two other high-risk flaws. CVE-2026-49366 is a command injection vulnerability found in filename completion, while CVE-2026-49367 represents a command execution flaw affecting guest accounts. Both vulnerabilities could allow an attacker to execute arbitrary commands if they can manipulate project content or guest sessions within the IDE.

The advisory further highlights critical weaknesses specifically impacting remote development features within IntelliJ IDEA. These include CVE-2026-64812, which allows unauthorized input injection, and CVE-2026-64813, enabling unauthorized modification of settings during active Remote Development sessions. An additional high-severity issue, CVE-2026-64814, permits unauthorized file access within the same Remote Development context, significantly escalating the risk for teams that expose IDE backends via SSH or in shared development environments.

TeamCity Vulnerabilities

On the continuous integration front, JetBrains has addressed four significant vulnerabilities in TeamCity. A critical remote code execution flaw, CVE-2026-65907, exists within Git VCS roots. This vulnerability allows attackers to achieve code execution by configuring malicious repositories.

Another high-severity issue, CVE-2026-65906, involves code execution through a Kotlin DSL sandbox escape within build configuration scripts. Furthermore, CVE-2026-59793 addresses arbitrary file access in Perforce integration, while CVE-2026-59794 resolves a stored cross-site scripting (XSS) vulnerability found in cloud profile data.

Specifically, CVE-2026-65907, impacting TeamCity Git VCS roots, is categorized under CWE-94 (Code Injection). This enables attackers to achieve remote code execution on vulnerable TeamCity servers by crafting malicious Git root settings. The presence of CVE-2026-65906 (TeamCity Kotlin DSL sandbox escape) and CVE-2026-59793 (arbitrary file access in Perforce) underscores how compromised Version Control System (VCS) integrations can be exploited to pivot from source control systems directly into the build infrastructure.

Patch Availability

For IntelliJ IDEA, the critical workspace ID path traversal vulnerability (CVE-2026-59792) has been resolved in versions 2026.1.4 and 2026.2. Users operating older 2026.1.x and 2025 branches remain vulnerable and must upgrade to a patched version.

For TeamCity, CVE-2026-65906 and CVE-2026-65907, along with the arbitrary file access and XSS issues, have been remediated in TeamCity versions 2026.1.2 and 2025.11.6.

JetBrains strongly advises users to immediately upgrade to the patched versions of IntelliJ IDEA and TeamCity. In addition to patching, development teams should meticulously review their build configurations and VCS roots for any untrusted or user-supplied scripts.

What You Should Do

• Immediately upgrade IntelliJ IDEA to versions 2026.1.4 or 2026.2 (or later).
• Immediately upgrade TeamCity to versions 2026.1.2 or 2025.11.6 (or later).
• Scrutinize all build configurations and VCS roots for any untrusted or user-supplied scripts.
• Limit the number of individuals who can define Kotlin DSL, Git, and Perforce roots.
• Enforce project trust prompts within IntelliJ IDEA.
• Actively monitor build logs for any suspicious script execution or unexpected agent behavior.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.