# CVE-2026-118696

JetBrains IDEs trusted revoked Emudhra intermediate certificates in embedded browser.

- Page: https://www.vulneraibility.com/cve/CVE-2026-118696
- CVSS: 8.0
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.27% (percentile 19.7)
- CISA SSVC: exploitation none, automatable no, technical impact total (assessed 2026-10-30)
- Weakness: CWE-299
- Published: 2026-10-30

## Affected versions

- JetBrains CLion: affected >= 2026.2 and < 2026.2.4.1; >= 2026.1 and < 2026.1.5.2; < 2025.3.6.3
- JetBrains DataGrip: affected >= 2026.2 and < 2026.2.6.1; >= 2026.1 and < 2026.1.4.1; < 2025.3.6.1
- JetBrains DataSpell: affected >= 2026.1 and < 2026.1.3.1; < 2025.3.3.1
- JetBrains GoLand: affected >= 2026.2 and < 2026.2.4; >= 2026.1 and < 2026.1.5.1; < 2025.3.5.2
- JetBrains IntelliJ IDEA: affected >= 2026.2 and < 2026.2.4; >= 2026.1 and < 2026.1.5.1; < 2025.3.6.2
- JetBrains PhpStorm: affected >= 2026.2 and < 2026.2.4; >= 2026.1 and < 2026.1.5.1; < 2025.3.6.2
- JetBrains PyCharm: affected >= 2026.2 and < 2026.2.4; >= 2026.1 and < 2026.1.5.1; < 2025.3.6.2
- JetBrains Rider: affected >= 2026.2 and < 2026.2.4; >= 2026.1 and < 2026.1.5.3; < 2025.3.5.3
- JetBrains RubyMine: affected >= 2026.2 and < 2026.2.4; >= 2026.1 and < 2026.1.5.1; < 2025.3.6.2
- JetBrains RustRover: affected >= 2026.2 and < 2026.2.5; >= 2026.1 and < 2026.1.4.1; < 2025.3.7.1
- JetBrains WebStorm: affected >= 2026.2 and < 2026.2.4; >= 2026.1 and < 2026.1.5.1; < 2025.3.6.2

A version outside these ranges is not a statement that it is unaffected.

## Impact

Embedded browser accepted revoked intermediate certs enabling TLS MITM, credential theft, and delivery of malicious content to developers.

## Action

Immediate action required

## Recommendation

Update affected JetBrains IDEs to the vendor fixed versions immediately.

## References

- [other] https://www.jetbrains.com/privacy-security/issues-fixed/
- [other] https://blog.jetbrains.com/security/2026/10/compromised-emudhra-certificates-ides/
- [other] https://emudhra.com/en/post/certificate-security-incident
- [other] https://bugzilla.mozilla.org/show_bug.cgi?id=2083449

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.