JetBrains ships fixes so its IDEs, Toolbox App, Gateway and ReSharper stop trusting the eight compromised eMudhra intermediate certificates; OS updates do not cover them
JetBrains says its tools check TLS certificates against the trust store bundled in the JetBrains Runtime (and, for IDEs, the embedded JCEF browser), so the operating-system and browser updates that already distrust the eight compromised eMudhra intermediates do not protect them. A network attacker holding those keys could impersonate services the tools connect to. The jetbrainsd background service has its own list and is tracked as CVE-2026-118697 (CVSS 9.0), fixed in jetbrainsd 0.9.9728.
- Fixed: for example IntelliJ IDEA 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.4; Toolbox App 3.9.1 and 3.8.2; matching updates for PyCharm, WebStorm, Rider, GoLand, CLion, DataGrip, RustRover, Gateway and ReSharper (see the blog for each).
- Gaps: the 2025.2.6.x updates contain only the runtime fix, with a separate JCEF hotfix to follow; JetBrains gives a workaround to disable JCEF meanwhile. IDE 2025.1 and earlier and Toolbox App 3.7 and earlier get no fix.
- Exploitation: JetBrains is not aware of any against its users.
Sources: JetBrains: Compromised eMudhra certificates, update your JetBrains IDEs, ReSharper, .NET tools, Toolbox App and Gateway now · NVD: CVE-2026-118697 (jetbrainsd)