---
title: JetBrains ships fixes so its IDEs, Toolbox App, Gateway and ReSharper stop trusting the eight compromised eMudhra intermediate certificates; OS updates do not cover them | ctxsec
url: https://ctxsec.com/items/jetbrains-ides-toolbox-emudhra-compromised-intermediates-cve-2026-118697
description: ""
status: "official (JetBrains security blog; CVE-2026-118697); no known exploitation against JetBrains users"
published: 2026-10-30
---

> 

[← Cybersecurity News](/news) · [markdown](/items/jetbrains-ides-toolbox-emudhra-compromised-intermediates-cve-2026-118697.md)

official (JetBrains security blog; CVE-2026-118697); no known exploitation against JetBrains users

2026-10-30

### JetBrains ships fixes so its IDEs, Toolbox App, Gateway and ReSharper stop trusting the eight compromised eMudhra intermediate certificates; OS updates do not cover them

JetBrains says its tools check TLS certificates against the trust store bundled in the JetBrains Runtime (and, for IDEs, the embedded JCEF browser), so the operating-system and browser updates that already distrust the eight compromised **eMudhra** intermediates do not protect them. A network attacker holding those keys could impersonate services the tools connect to. The `jetbrainsd` background service has its own list and is tracked as **CVE-2026-118697** (CVSS 9.0), fixed in jetbrainsd 0.9.9728.

- **Fixed:** for example IntelliJ IDEA 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.4; Toolbox App 3.9.1 and 3.8.2; matching updates for PyCharm, WebStorm, Rider, GoLand, CLion, DataGrip, RustRover, Gateway and ReSharper (see the blog for each).
- **Gaps:** the 2025.2.6.x updates contain only the runtime fix, with a separate JCEF hotfix to follow; JetBrains gives a workaround to disable JCEF meanwhile. IDE 2025.1 and earlier and Toolbox App 3.7 and earlier get no fix.
- **Exploitation:** JetBrains is not aware of any against its users.

Sources: [JetBrains: Compromised eMudhra certificates, update your JetBrains IDEs, ReSharper, .NET tools, Toolbox App and Gateway now](https://blog.jetbrains.com/security/2026/10/compromised-emudhra-certificates-ides/) · [NVD: CVE-2026-118697 (jetbrainsd)](https://nvd.nist.gov/vuln/detail/CVE-2026-118697)