CVE-2026-86505: 
JetBrains IntelliJ IDEA vulnerability analysis and mitigation

CVE-2026-86505 is a missing project-trust check vulnerability in JetBrains IntelliJ IDEA that causes project metadata to be leaked to JetBrains Marketplace without user authorization. It affects all versions of IntelliJ IDEA before 2026.2.2. The vulnerability was published on September 7, 2026, with a patch available in version 2026.2.2. It carries a CVSS v3.1 base score of 3.3 (Low) (GitHub Advisory, JetBrains).

The root cause is classified as CWE-201 (Insertion of Sensitive Information Into Sent Data): the IDE transmits project metadata to JetBrains Marketplace without first performing a project-trust verification check. Because the trust check is absent, simply opening or interacting with a project in the IDE can trigger the metadata transmission to an external third-party service. The attack vector is local, requires no privileges, but does require user interaction (e.g., opening a project), and the scope of impact is unchanged (GitHub Advisory).

Successful exploitation results in a low-level confidentiality impact: project metadata — which may include project structure, configuration details, and other potentially sensitive development information — is disclosed to JetBrains Marketplace without the user's explicit consent. There is no impact on integrity or availability. The exposure is limited to metadata rather than source code or credentials, but could reveal internal project organization or tooling details to an external party (GitHub Advisory, JetBrains).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.109% (1st percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation is not automatable and requires local user interaction (GitHub Advisory).

JetBrains has released a fix in IntelliJ IDEA version 2026.2.2. Users should update to version 2026.2.2 or later as the primary remediation step. Additionally, organizations should review any project metadata that may have been transmitted to JetBrains Marketplace prior to patching and assess whether sensitive project configuration details were exposed. Implementing stricter project-trust policies within the development environment is also recommended as a complementary measure (JetBrains, GitHub Advisory).