JetBrains fixes 22 flaws across YouTrack, IntelliJ IDEA and Ktor

JetBrains fixes 22 flaws across YouTrack, IntelliJ IDEA and Ktor

6 November 2026: JetBrains has shipped fixes for 22 vulnerabilities across eight products, two rated critical and 20 high by Italy's national cyber agency, ACN. The flaws include remote code execution, privilege escalation, authentication bypass and file write, and the list spans server products that administrators patch and desktop tools that depend on each developer updating.

Not yet independently verified. JetBrains' own list of fixed issues would not load as text for us, so this rests on Italy's ACN alone. We do not know which two CVEs are critical or which products they affect. We will update this when it can be confirmed, and remove this note.

Fixed versions by product

ACN's bulletin gives these as the releases to install:

• YouTrack: 2026.2.19656, 2026.1.14150 or 2025.3.170763
• Hub: 2026.2.52556
• Datalore: 2026.4
• Ktor: 3.6.1
• IntelliJ IDEA: 2026.3, 2026.2.4, 2026.1.5.1 or 2025.3.6.2
• WebStorm: 2026.2.3
• CLion: 2026.2.4.1
• Junie CLI: 26.8.24

The CVEs fall in the range CVE-2026-123276 to CVE-2026-123327. ACN's alert is numbered AL05/261106/CSIRT-ITA and was issued on 6 November.

Servers first, because they hold the most

Self-hosted YouTrack, Hub and Datalore are the obvious starting point. YouTrack holds a company's issues, often including security reports and customer details, and Hub handles single sign-on and permissions across JetBrains server products. An authentication bypass in that part of the estate would matter a great deal more than the same flaw in a desktop tool, although the bulletin does not tie specific flaw types to specific products.

Administrators should patch those before anything else and check that each sits on one of the listed YouTrack lines. A server on an older line than 2025.3 is not covered by the versions listed.

Ktor and the desktop tools take a different route

Ktor is a framework, so its fix means more than installing an update. Teams have to raise the dependency to 3.6.1 and rebuild and redeploy each service that uses it. A build-file search across repositories will show where it appears, including internal libraries that bring it in without anyone having chosen it directly.

IDEs update on each developer's machine, and that leaves room for drift. Organisations that manage JetBrains licences centrally should check which versions are in use rather than assume everyone has clicked the prompt, because a developer laptop holds source code and credentials. Junie CLI, the company's coding agent tool, deserves the same treatment, since a command line tool may be installed outside the usual IDE update path and may sit on build machines.

Teams should go to JetBrains' own fixed-issues page for the per-CVE detail before deciding what can wait. Our bug tracking software category lists four products, and project management software lists seventeen.

Sources

• ACN (Italy's national cybersecurity agency): Vulnerabilities fixed in JetBrains products, AL05/261106/CSIRT-ITA, 6 November 2026, 6 November 2026
• JetBrains: Fixed security issues (page did not load as text, read 7 November 2026), 7 November 2026