JetBrains IDEs still trusted compromised eMudhra certificates

JetBrains IDEs still trusted compromised eMudhra certificates

30 October 2026: JetBrains has shipped updates for every one of its IDEs, ReSharper, Gateway and the Toolbox App because they still trusted eight intermediate certificates of the Indian certificate authority eMudhra whose private keys were compromised in October. Someone holding those keys could pose as a site or service the tools connect to. JetBrains published two CVEs on 30 October: CVE-2026-118697, rated 9.0, for the jetbrainsd background daemon, and CVE-2026-118696, rated 8.0, for the IDEs' embedded browser.

Not yet independently verified. The count of eight compromised certificates and the absence of known exploitation are JetBrains' statements; we did not read eMudhra's own incident statement in full. We will update this when it can be confirmed, and remove this note.

Updating Windows, macOS or Linux does not help. The tools use the trust store of the JetBrains Runtime bundled with them, not the operating system's, so the fix has to come from JetBrains. The company says it is not aware of any exploitation against its users.

Versions that carry the fix

JetBrains lists these fixed releases among others:

• IntelliJ IDEA 2026.2.4, 2026.1.5.1, 2025.3.6.2 and 2025.2.6.4, plus the 2026.3 release candidate;
• PyCharm, PhpStorm, RubyMine, WebStorm and GoLand 2026.2.4 and 2026.1.5.1;
• Rider and ReSharper 2026.2.4, 2026.1.5.3 and 2025.3.5.3; CLion 2026.2.4.1 and 2026.1.5.2;
• DataGrip 2026.2.6.1, RustRover 2026.2.5, DataSpell 2026.1.3.1;
• Gateway 2026.1.4, 2025.3.3 and 2025.2.6;
• Toolbox App 3.9.1 and 3.8.2, and jetbrainsd 0.9.9728.

There is no fix for IDE versions 2025.1 and earlier or for Toolbox App 3.7 and earlier; those users have to move to a supported line. The 2025.2.6 updates carry only the runtime fix, with the embedded browser fix to follow in a later hotfix, so JetBrains advises turning the embedded browser off on that line until then.

Side effects of the new trust store

The fixed runtime blocks four root certificates: emSign ECC Root CA G3, emSign Root CA G1, emSign Root CA G2 and AAA Certificate Services. JetBrains warns that in rare cases an IDE will no longer reach a server whose certificate chain runs through one of the removed roots. The fix for that sits with the server's owner, who has to replace the certificate, so teams with internal plugin repositories, licence servers or package mirrors on those chains should check them before rolling the update out.

If you cannot update yet

JetBrains gives a manual workaround: copy the runtime's cacerts file, delete the aliases "comodoaaaca [jdk]" and "emsigneccrootcag3 [jdk]" from the copy with keytool, point the javax.net.ssl.trustStore option at the full path of the copy under Help, Edit Custom VM Options, and turn off the embedded browser. It warns that a wrong path silently leaves the IDE unprotected, so the update is the safer route. Companies that pin IDE versions centrally need the new builds approved before developers can take them.

Sources

• JetBrains Security blog: Compromised eMudhra certificates, update your JetBrains IDEs, ReSharper, .NET tools, Toolbox App and Gateway now, 30 October 2026
• JetBrains: CVE-2026-118696 record (CNA), 30 October 2026
• JetBrains: CVE-2026-118697 record (CNA), 30 October 2026
• eMudhra: certificate security incident (updated 2026-10-30), 30 October 2026