CVE-2026-64815: jetbrains intellij_idea Code Injection

Analyzed

Published 23-07-2026Last modified 24-07-2026

Vulnerability summary

CVE-2026-64815 is a critical (CVSS 9.8) Code Injection vulnerability in jetbrains intellij_idea. EPSS estimates a 0.48% chance of exploitation in the next 30 days, higher than 40.5% of scored vulnerabilities.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.8/10

010

Critical · v3.1 (NVD)

EPSS score

0.48%

0%100%

Low · +0.15 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

23-07-2026
PublishedVulnerability first disclosed.
24-07-2026
Last modifiedVulnerability information updated.

Description

In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files

CVSS metrics

2 scores · 2 sources · 1 version

v3.19.8

EPSS trend

Probability

0.48%

Chance of exploitation in the next 30 days

Percentile

41%

Versus all other CVEs

30-day change

Increase +0.15 pp

From 0.33% on 22-09-2026

22-09-202622-10-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Affected systems

Jetbrains1 product

intellij_idea< 2026.2

1 vendor · 1 product

References

1 links

www.jetbrains.com/privacy-security/issues-fixed/Vendor Advisory