CVE-2026-86502: 
JetBrains IntelliJ IDEA vulnerability analysis and mitigation

CVE-2026-86502 is a missing TLS and authentication vulnerability in JetBrains IntelliJ IDEA's IJent gRPC server that allows local code execution on Remote Development hosts. It affects all versions of IntelliJ IDEA before 2026.2.2 and was published on September 7, 2026. The vulnerability carries a CVSS v3.1 base score of 8.4 (High), classified under CWE-306 (Missing Authentication for Critical Function) (GitHub Advisory, JetBrains).

The root cause is the absence of TLS encryption and authentication controls on the IJent gRPC server component used in IntelliJ IDEA's Remote Development feature (CWE-306). Because the gRPC server neither enforces transport-layer security nor requires caller authentication, any local user on the Remote Development host can connect to the service and issue arbitrary commands. The attack vector is local (AV:L), requires no privileges (PR:N), and no user interaction (UI:N), making exploitation straightforward for any user with local access to the affected host (GitHub Advisory, JetBrains).

Successful exploitation allows any local user on a Remote Development host to execute arbitrary code with the privileges of the IJent gRPC server process, resulting in high confidentiality, integrity, and availability impact. An attacker could gain full control of the remote host environment, access sensitive source code and credentials stored in the IDE, and potentially pivot to other systems accessible from the compromised host (GitHub Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The NVD SSVC assessment confirms exploitation is currently "none" and the attack is not automatable. The EPSS score is approximately 0.144% (4th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Identify target: Locate a Remote Development host running JetBrains IntelliJ IDEA before version 2026.2.2 with the Remote Development feature active and the IJent gRPC server running.
2. Enumerate the gRPC service: From a local session on the host, identify the port or socket on which the IJent gRPC server is listening (e.g., using ss -tlnp or netstat -tlnp on Linux).
3. Connect without authentication: Use a gRPC client tool (e.g., grpcurl or a custom gRPC client) to connect directly to the IJent gRPC server endpoint without providing any credentials or TLS certificates, since neither is enforced.
4. Invoke code execution RPC: Call the appropriate gRPC method exposed by the IJent server to execute arbitrary commands or code on the Remote Development host.
5. Achieve full host control: Leverage the code execution capability to establish persistence, exfiltrate data, or pivot to other systems accessible from the compromised host (GitHub Advisory).

• Network: Unexpected local connections to the IJent gRPC server port from processes or users other than the IntelliJ IDEA IDE process; unusual gRPC traffic on loopback or local network interfaces.
• Process: Unexpected child processes spawned by the IJent gRPC server process (e.g., shells, scripting interpreters, or network tools); processes running under the IJent service account that are inconsistent with normal IDE operation.
• Logs: System logs showing new local connections to the gRPC server port from unauthorized users or processes; audit logs recording unexpected command execution originating from the IJent service.
• File System: New or modified files in the IntelliJ IDEA installation or configuration directories created by non-IDE processes; unexpected scripts or binaries dropped in writable directories accessible to the IJent service account.

The primary remediation is to upgrade JetBrains IntelliJ IDEA to version 2026.2.2 or later, which adds TLS and authentication to the IJent gRPC server (JetBrains, GitHub Advisory). As a temporary workaround, administrators should restrict local access to Remote Development hosts to trusted users only, and use host-based firewall rules or network segmentation to limit which processes and users can connect to the IJent gRPC service port. Isolating Remote Development hosts in environments with strict multi-user access controls reduces the attack surface until patching is possible.

The vulnerability received routine coverage from vulnerability tracking services including CVEFeed, VulDB, and Vulners shortly after disclosure on September 7, 2026. Social media mentions appeared on Mastodon and Bluesky via automated CVE tracking accounts. No notable independent researcher commentary or significant media coverage beyond standard vulnerability aggregation has been identified.