CVE-2026-86504
Quick assessment
Affected
JetBrains IntelliJ IDEA
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 JetBrains IntelliJ IDEA 2026.2.2 之前的版本中，由于在构建 Dev Container（开发容器）之前缺少项目信任确认机制，可能导致宿主层级（host-level）的代码执行漏洞。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| JetBrains | IntelliJ IDEA | < 2026.2.2 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86504
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code execution
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
从非可信控制范围包含功能例程
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| JetBrains | IntelliJ IDEA | 0 ~ 2026.2.2 | - |
|
II. Public POCs for CVE-2026-86504
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86504
请登录查看更多情报信息。
Vendor Pages for CVE-2026-86504 (1)
Same Patch Batch · JetBrains · 2026-09-07 · 29 CVEs total
| CVE-2026-86478 | 9.8 CRITICAL | YouTrack低版本Helpdesk不当认证致账户接管 |
| CVE-2026-86480 | 9.8 CRITICAL | JetBrains Hub <2026.2.52442 认证绕过及权限提升漏洞 |
| CVE-2026-86482 | 8.8 HIGH | JetBrains YouTrack 2026.2.18634前越权漏洞 |
| CVE-2026-86492 | 8.5 HIGH | JetBrains YouTrack 2026.2.18634 前跨租户令牌窃取 |
| CVE-2026-86502 | 8.4 HIGH | IntelliJ IDEA 2026.2.2前gRPC服务认证缺失致本地代码执行 |
| CVE-2026-86479 | 8.0 HIGH | YouTrack 2026.2等版本存在IDOR授权缺陷 |
| CVE-2026-86498 | 7.7 HIGH | JetBrains YouTrack 低版本 PPUT 请求权限绕过漏洞 |
| CVE-2026-86494 | 7.7 HIGH | JetBrains YouTrack 2026.2.18634 前克隆白板越权漏洞 |
| CVE-2026-86497 | 6.8 MEDIUM | YouTrack 2026.2.18769前凭据泄露漏洞 |
| CVE-2026-86495 | 6.5 MEDIUM | JetBrains YouTrack 2026.2.18687前权限检查缺失 |
| CVE-2026-86490 | 6.5 MEDIUM | YouTrack低于2026.2.18634权限检查不当 |
| CVE-2026-86488 | 6.5 MEDIUM | JetBrains YouTrack 低版本 iDOR 漏洞 |
| CVE-2026-86489 | 6.5 MEDIUM | JetBrains YouTrack 2026.2.18634 之前 IDOR 漏洞 |
| CVE-2026-86493 | 6.5 MEDIUM | JetBrains YouTrack权限检查缺陷 |
| CVE-2026-86506 | 5.9 MEDIUM | GoLand 2026.2.2.1前 pprof服务缺失认证 |
| CVE-2026-86500 | 5.5 MEDIUM | JetBrains YouTrack 2026.1.14047 前 权限提升 |
| CVE-2026-86483 | 5.4 MEDIUM | JetBrains YouTrack 2026.2.18634前存储型XSS漏洞 |
| CVE-2026-86484 | 4.6 MEDIUM | JetBrains YouTrack 2026.2.18634前存储型XSS |
| CVE-2026-86496 | 4.3 MEDIUM | JetBrains YouTrack 2026.2.18769 前访问控制漏洞 |
| CVE-2026-86499 | 4.3 MEDIUM | YouTrack 2026.1.14047 前预定义搜索字段权限泄露 |
Showing top 20 of 29 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same weakness: CWE-829
-
CVE-2026-86169
Axolotl through 0.18.0 Remote Code Execution via Multipack P -
CVE-2026-58569
Dell PowerStore 软件供应链问题漏洞 -
CVE-2026-18252
Inclusion of Functionality from Untrusted Control Sphere in -
CVE-2026-76139
Acm-operator-bundle: acm-operator-bundle: bundle build execs -
CVE-2026-73367
WordPress Easy Google Maps plugin < 1.14.2 - Remote File Inc
V. Comments for CVE-2026-86504
No comments yet