JetBrains Updates Address Compromised Certificate Trust
Tech GuruQuick Answer
JetBrains released product-specific fixes for compromised eMudhra certificate trust. Inventory IDEs, Toolbox, Gateway, .NET tools, JBR, JCEF and jetbrainsd, deploy the listed fixed builds, handle unsupported releases, validate certificate behavior and update reachability, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory JetBrains IDEs and .NET tools, Toolbox App, Gateway, bundled JBR and JCEF versions, jetbrainsd, managed plugins, network update restrictions, owners, and deployment tooling. Apply each product's exact fixed build and separate JBR, JCEF and jetbrainsd paths; do not assume an operating-system certificate update or one updated IDE fixes every layer. Update to the latest fixed product release, ensure jetbrainsd is 0.9.9728 or later, permit JCEF certificate updates or disable JCEF as documented, and replace unsupported builds. Confirm installed product, runtime and daemon versions, verify Google update reachability where JCEF depends on it, test trusted services, reject unexpected certificates, and retain deployment evidence.
Last verified: 2026-10-31 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | JetBrains IDEs, ReSharper and .NET tools, Gateway, Toolbox App, JetBrains Runtime, JCEF, and jetbrainsd |
|---|---|
| Advisory | JetBrains compromised eMudhra certificate bulletin |
| CVEs | CVE-2026-118696, CVE-2026-118697 |
| Authoritative release date | 2026-10-30 17:31:04.317 UTC |
| Authority revision date | 2026-10-30 18:49:59.260 UTC |
| Affected versions | Authority-listed product builds before their fixed bugfix releases; IDEs 2025.1 and earlier and Toolbox App 3.7 and earlier will not receive the fix. JCEF and jetbrainsd have separate remediation paths. |
| Fixed version | The product-specific builds in the JetBrains bulletin, Toolbox App 3.9.1 or 3.8.2, jetbrainsd 0.9.9728, and the listed fixed JetBrains Runtime builds |
| CVSS base score | 8.0 / 9.0 (CVSS v3.1) |
| CVSS severity | High to Critical |
| Exploitation status | JetBrains states that it was not aware of exploitation against JetBrains users when the bulletin was published.; no exploitation claim is inferred. |
What Changed
JetBrains updated product trust stores after eight eMudhra intermediate certificate keys were compromised; operating-system trust updates alone do not protect bundled JBR, JCEF, or jetbrainsd paths.
What To Validate Now
- Inventory. Inventory JetBrains IDEs and .NET tools, Toolbox App, Gateway, bundled JBR and JCEF versions, jetbrainsd, managed plugins, network update restrictions, owners, and deployment tooling.
- Establish applicability. Apply each product's exact fixed build and separate JBR, JCEF and jetbrainsd paths; do not assume an operating-system certificate update or one updated IDE fixes every layer.
- Remediate. Update to the latest fixed product release, ensure jetbrainsd is 0.9.9728 or later, permit JCEF certificate updates or disable JCEF as documented, and replace unsupported builds.
- Validate. Confirm installed product, runtime and daemon versions, verify Google update reachability where JCEF depends on it, test trusted services, reject unexpected certificates, and retain deployment evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Some 2025.2 IDE fixes initially cover JBR but not JCEF, and removed roots can break legitimate servers. Follow the product matrix and coordinate certificate replacement where needed.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
