Windows apps · JetBrains

IntelliJ IDEA Ultimate Edition security updates

The latest version of IntelliJ IDEA Ultimate Edition is 2026.2.3, released September 16, 2026. Patch Radar has 17 security fixes for IntelliJ IDEA Ultimate Edition, closing 61 CVEs. The newest security fix is IntelliJ IDEA Ultimate Edition 2026.2.3, released September 16, 2026. 23 CVEs have no fix yet.

23 with no fix yet
Latest version
2026.2.3
Released Sep 16, 2026
Security fixes
17
On record in Patch Radar
CVEs
61
Closed by those fixes
Exploited
0
Vendor report or CISA KEV

CVEs with no fix yet

PriorityCVETitleStatus
Urgent CVE-2026-118697 WebStorm and 11 others: Improper Certificate Validationno-fix
High CVE-2026-118696 WebStorm and 12 others: Improper Check for Certificate Revocationno-fix
High CVE-2026-123301 IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 dOM-based XSS in the OpenAPI preview error view was possibleno-fix
High CVE-2026-123304 IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured ShellCheck…no-fix
High CVE-2026-123305 IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via unpacking Dev Container archives…no-fix
High CVE-2026-123306 IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be added to the…no-fix
High CVE-2026-123838 IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form…no-fix
High CVE-2026-123841 IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings…no-fix
High CVE-2026-123842 IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 arbitrary file write was possible via symlinks when extracting…no-fix
High CVE-2026-123848 IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 host name verification was missing for server TLS certificatesno-fix
High CVE-2026-123849 IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform…no-fix
Routine CVE-2026-123278 IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker…no-fix
Routine CVE-2026-123308 IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 code execution via the document import was possible in untrusted…no-fix
Routine CVE-2026-123310 IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 kotlin scripts could trigger dependency downloads from arbitrary…no-fix
Routine CVE-2026-123313 IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 improper checks could enable disabled plugins via external dependency…no-fix
Routine CVE-2026-123833 IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 database connections could be established in untrusted projectsno-fix
Routine CVE-2026-123839 IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 opening arbitrary URLs without confirmation was possible via…no-fix
Routine CVE-2026-123840 IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 hTML injection was possible in Remote Development editor tabsno-fix
Routine CVE-2026-123843 IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent configurationno-fix
Routine CVE-2026-123844 IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 sSRF was possible via custom plugin repositoriesno-fix
Routine CVE-2026-123845 IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via JSON Schema references in untrusted…no-fix
Routine CVE-2026-123846 IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON Schema…no-fix
Routine CVE-2026-123847 IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 command execution was possible via control characters in terminal…no-fix

Security fixes, newest first

PriorityFixFixed inCVEsExploitedReleased
Urgent IntelliJ IDEA Ultimate Edition 2026.2.32026.2.3 25 Sep 16, 2026
High IntelliJ IDEA Ultimate Edition 2025.22025.2 4 Aug 4, 2025
Routine IntelliJ IDEA Ultimate Edition 2024.32024.3 1 Nov 12, 2024
High IntelliJ IDEA Ultimate Edition 2024.1.32024.1.3 1 Jun 10, 2024
Urgent IntelliJ IDEA Ultimate Edition 2024.12024.1 4 Apr 4, 2024
High IntelliJ IDEA Ultimate Edition 2023.22023.2 1 Jul 26, 2023
Routine IntelliJ IDEA Ultimate Edition 2023.1.42023.1.4 1 Jul 12, 2023
High IntelliJ IDEA Ultimate Edition 2023.12023.1 4 Mar 28, 2023
High IntelliJ IDEA Ultimate Edition 2022.3.12022.3.1 2 Dec 20, 2022
Routine IntelliJ IDEA Ultimate Edition 2022.32022.3 3 Nov 30, 2022
High IntelliJ IDEA Ultimate Edition 2022.2.22022.2.2 1 Sep 14, 2022
High IntelliJ IDEA Ultimate Edition 2022.22022.2 2 Jul 26, 2022
High IntelliJ IDEA Ultimate Edition 2022.12022.1 8 Apr 12, 2022
Routine IntelliJ IDEA Ultimate Edition 2021.3.32021.3.3 1 Mar 15, 2022
Urgent IntelliJ IDEA Ultimate Edition 2021.3.22021.3.2 1 Jan 27, 2022
High IntelliJ IDEA Ultimate Edition 2021.3.12021.3.1 1 Dec 28, 2021
High IntelliJ IDEA Ultimate Edition 2021.32021.3 1 Nov 27, 2021

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.