Ing. Calogero Bono
The National Cybersecurity Agency has published alert AL05/261106/CSIRT-ITA on JetBrains security updates. The vendor fixed multiple vulnerabilities, two rated critical and 20 rated high, across eight products. The bulletin is dated 6 November 2026. It matters because it hits tools that software developers use every day, and a compromised development environment is a sensitive entry point.
A few terms before we get into the facts. CSIRT Italia is the national team that handles cyber incidents and signs the alert. Remote Code Execution means the ability to run commands on a system remotely. Privilege Escalation is gaining permissions beyond those granted. Authentication Bypass lets an attacker get around login. CVE is the code that uniquely identifies a known vulnerability.
What did the ACN flag about JetBrains?
According to the official ACN entry, JetBrains released updates to fix multiple vulnerabilities. Two are rated critical and 20 high.
The affected products are YouTrack, WebStorm, Ktor, Junie CLI, IntelliJ IDEA, Hub, Datalore and CLion. Version 2.0 of the alert is listed as published on 6 November 2026.
The total of 22 serious flaws is our own count, the sum of the two critical and the 20 high ones indicated by the agency.
What kinds of attacks do they make possible?
The ACN lists seven types of risk.
- Remote Code Execution
- Privilege Escalation
- Authentication Bypass
- Information Disclosure
- Arbitrary File Write
- Security Restrictions Bypass
- Spoofing
The entry does not, however, tie each type to a specific product. For that detail you need to consult the CVEs cited by the agency and the vendor's advisories.
Which versions need updating?
The ACN indicates as vulnerable the versions preceding those listed.
- YouTrack, before 2026.2.19656, 2026.1.14150 or 2025.3.170763 depending on the branch
- WebStorm, before 2026.2.3
- Ktor, before 3.6.1
- Junie CLI, before 26.8.24
- Hub, before 2026.2.52556
- Datalore, before 2026.4
- CLion, before 2026.2.4.1
What about IntelliJ IDEA in particular?
For IntelliJ IDEA the affected versions depend on the branch. In the 2026.3.x branch those are the versions before 2026.3, in 2026.2.x the ones before 2026.2.4, in 2026.1.x the ones before 2026.1.5.1. Below 2025.3.6.2, earlier versions are involved.
Teams using several branches therefore need to check the exact version on each machine, looking at the year alone is not enough.
It is not the first time the agency has flagged risks in developer tools, as in the case of the malicious versions of an extension for Cursor.
Limits to know
The ACN entry does not list the individual CVEs in its text, nor does it say which of the two critical flaws affects which product. There are no indications of exploitation already in progress. For technical details you need to rely on JetBrains' advisories. The bulletin is also at version 2.0 and may still be updated.
What changes for those working in digital
For developers, updating IDEs and related tools should be treated as security maintenance, not a convenience. YouTrack and Hub are often installed on company servers, where the risk of unauthorized access is more concrete. If you manage these services, keeping them on hosting with security updates shortens exposure windows. Also check Ktor in your projects, since the library ends up inside applications shipped to customers. An inventory of the versions in use saves hours when an alert arrives.
Our take
What strikes us is how long the list is, eight products in a single alert. Development tools have access to code, credentials and repositories, so they deserve to be treated as critical infrastructure as much as a server. Yet they are often updated with less rigor, because they are perceived as personal programs. The ACN is right to flag them, but an internal practice is needed, as with the flaws in Apache OFBiz. Updating late remains the most avoidable risk.
Frequently asked questions
How many vulnerabilities did JetBrains fix?
Two critical and 20 high, according to the ACN. The alert only considers high and critical CVEs, so the real total could be higher.
Which JetBrains products are affected?
Eight products. They are YouTrack, WebStorm, Ktor, Junie CLI, IntelliJ IDEA, Hub, Datalore and CLion.
What does the ACN recommend?
Updating promptly to the latest available version. The recommendation is in line with the vendor's statements.
When was the alert published?
On 6 November 2026. It carries the code AL05/261106/CSIRT-ITA and is at version 2.0.
Is updating the IDE enough?
No. Servers such as YouTrack, Hub and Datalore and libraries such as Ktor also need checking, because they are listed among the affected products.
What to check in the coming weeks on JetBrains tools
The alert is at version 2.0 and may still change. It is worth following developments and getting your tool inventory in order.
- Check whether the ACN publishes new revisions of the entry with the CVEs.
- Read JetBrains' advisories to see which critical flaws touch your products.
- Set a recurring reminder to verify the versions of your team's development tools.
