CVE-2026-75055: 
JetBrains IntelliJ IDEA vulnerability analysis and mitigation

CVE-2026-75055 is an XML External Entity (XXE) injection vulnerability in JetBrains IntelliJ IDEA's Hadoop ResourceManager integration that allows a local attacker to read arbitrary files on the affected system. It affects all versions of IntelliJ IDEA before 2026.2.1. The vulnerability was published on August 17, 2026, with a patch available in version 2026.2.1. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, JetBrains).

The vulnerability is classified as CWE-611 (Improper Restriction of XML External Entity Reference), where the Hadoop ResourceManager component in IntelliJ IDEA fails to properly restrict the processing of XML external entities. An attacker can craft a malicious XML payload referencing local file URIs, which the application processes without adequate sanitization, resulting in disclosure of local file contents. Exploitation requires local access and user interaction — the victim must trigger the vulnerable XML parsing functionality within the IDE (GitHub Advisory, JetBrains).

Successful exploitation results in high confidentiality impact, allowing an attacker to read arbitrary local files accessible to the IntelliJ IDEA process — potentially including source code, configuration files, credentials, SSH keys, or other sensitive developer artifacts. There is no integrity or availability impact. The attack is limited to the local system where IntelliJ IDEA is running, with no scope change, reducing the risk of direct lateral movement (GitHub Advisory).

There is currently no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable, as it requires user interaction to trigger the vulnerable code path. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, JetBrains).

The primary remediation is to update JetBrains IntelliJ IDEA to version 2026.2.1 or later, which contains the fix for this vulnerability. As interim mitigations, administrators should disable XML External Entity processing where configurable, restrict local file access permissions for the IntelliJ IDEA process to minimize exposure of sensitive files, and avoid opening untrusted Hadoop project configurations within the IDE (JetBrains, GitHub Advisory).