CVE-2026-86502

IntelliJ IDEA before 2026.2.2 ships a Remote Development component, the IJent gRPC server, that runs on the remote host without TLS encryption or authentication (CWE-306). An attacker who can reach that endpoint — typically another local user or process on the same Remote Development host — can connect without credentials and invoke the service. The result is arbitrary code execution in the context of the user running the IDE backend (high confidentiality, integrity, and availability impact), though the CVSS vector (AV:L) shows exploitation requires local access to the host, not remote network access. Affected users are developers and teams who use IntelliJ IDEA's Remote Development feature to run IDE backends on remote hosts, especially shared multi-user servers. There is no known public proof-of-concept, the issue is not in CISA KEV, and EPSS puts 30-day exploitation probability at just 0.1%.

What to do: Upgrade IntelliJ IDEA to 2026.2.2 or later, which adds TLS and authentication to the IJent gRPC server. As an interim mitigation on shared or multi-user remote development hosts, isolate each user's IDE backend (containers, VMs, or per-user permissions) so other local users cannot reach the gRPC listener. Check Remote Development hosts for unauthenticated local IJent endpoints and restrict access to the owning user.