Critical Vulnerabilities in JetBrains IntelliJ IDEA and TeamCity Enable Remote Code Execution
JetBrains has released urgent security updates for IntelliJ IDEA and TeamCity to address several critical vulnerabilities that threaten remote development environments. The flaws could enable attackers to execute arbitrary code, modify build pipelines, and gain unauthorized access to files, making prompt patching essential for organizations using shared development setups.
In IntelliJ IDEA, the vulnerability tracked as CVE-2026-59792 stems from a directory traversal issue in the processing of workspace identifiers. This weakness may lead to remote code execution and received a maximum CVSS score of 9.8. The company has resolved the problem in versions 2026.1.4 and 2026.2.
TeamCity received multiple fixes addressing high-risk issues. CVE-2026-65907 allows code execution through specially crafted malicious Git repository configurations. Separately, CVE-2026-65906 permits attackers to escape the sandbox that protects Kotlin DSL scripts, potentially granting broader system access.
Additional vulnerabilities corrected in TeamCity include CVE-2026-59793, which enables arbitrary file access via the Perforce integration, and CVE-2026-59794, a persistent cross-site scripting flaw on the cloud profiles page. Both issues could be leveraged to compromise sensitive data or user sessions.
Administrators are strongly advised to apply the updates without delay. IntelliJ IDEA users should upgrade to the corrected releases, while TeamCity deployments should move to version 2026.1.2 or 2025.11.6 according to their current release line.
Related articles
Critical Vulnerability in JetBrains TeamCity Allows Unauthenticated Remote Code Execution
JetBrains has disclosed a critical vulnerability in its on-premises TeamCity CI/CD server that permits remote attackers to execute arbitrary operating system commands without authentication. The flaw, tracked as CVE-2026-63077, affects the agent polling protocol and can be exploited simply by accessing the TeamCity Server over HTTP or HTTPS. With a CVSSv3.1 base score of 9.8, the issue is rated Critical and could lead to data theft, configuration changes, or compromise of build artifacts and downstream pipelines. No in-the-wild exploitation had been observed at the time of disclosure. JetBrains has released fixed versions TeamCity 2026.1.3 and 2025.11.7, along with a patch plugin for all releases since 2017.1, and recommends restricting external access until updates can be applied.
Critical OS Command Injection Flaw in Arista VeloCloud Orchestrator Exploited in the Wild
Arista Networks has disclosed a critical vulnerability in the on-premises version of its VeloCloud Orchestrator product used for centralized SD-WAN management. The flaw, tracked as CVE-2026-16812, is an OS command injection issue that allows remote attackers to compromise the system without any authentication. Exploitation has already been confirmed, and the vulnerability carries the maximum CVSS base score of 10.0 in both version 4.0 and 3.1, classifying it as Critical. Successful attacks can impact the confidentiality, integrity, and availability of the orchestrator and all managed data. In addition, a compromised VeloCloud Orchestrator instance may grant attackers access to connected VeloCloud Edge devices across the network.
CISA Adds Exploited Flaws in FortiOS and VeloCloud Orchestrator to Known Exploited Vulnerabilities Catalog
The US Cybersecurity and Infrastructure Security Agency has added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog. CVE-2026-16812 affects the on-premises version of Arista VeloCloud Orchestrator and allows OS command injection that can lead to data leakage, tampering, and denial of service. The flaw carries a maximum CVSS v3.1 base score of 10.0 and is rated Critical. CVE-2025-68686 impacts Fortinet FortiOS and can be used to bypass specific patches and steal sensitive information when combined with another vulnerability that grants prior filesystem access. Federal agencies must remediate the VeloCloud issue by July 30 and the FortiOS issue by August 10.
Critical Vulnerabilities Patched in OpenAM with Release of Version 16.1.2
Multiple serious vulnerabilities have been disclosed in OpenAM, including remote code execution flaws that require no authentication. The Open Identity Platform development team released OpenAM 16.1.2 on July 20, 2026, addressing a total of 18 issues that encompass both native vulnerabilities and those in third-party dependencies. CVE-2026-62379 allows arbitrary Java classes specified in XML to be loaded and instantiated without validation, enabling unauthenticated remote code execution. CVE-2026-62263 stems from improper deserialization filtering in Java, similarly permitting unauthenticated code execution. The update also resolves an XSS vulnerability (CVE-2026-62280) on the authorization consent page and fixes issues in components such as Node.js, js-yaml, and websocket-driver. CVSS scores rate the two primary flaws as critical at 9.8 and 9.2 respectively.