JetBrains Patches IDEs and Toolbox App for Compromised eMudhra Certificates
JetBrains has released security updates for its IDEs, ReSharper, and Toolbox App to address compromised intermediate certificates that could facilitate…
JetBrains shipped security updates for IDEs, ReSharper, Gateway, and the Toolbox App to patch compromised private keys for eight intermediate certificates from eMudhra. A network attacker intercepting traffic could use these keys to impersonate connected websites and services, though JetBrains reports no known exploitation at publication time.
Because these tools rely on the bundled JetBrains Runtime (JBR) trust store, operating system updates won't help. The embedded browser (JCEF) is also affected. Additionally, the Toolbox App and IDEs run a background service, jetbrainsd, with its own built-in certificate list fixed in version 0.9.9728.
RubyMine fixed builds include 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, and 2025.2.6.3. IntelliJ IDEA gets 2025.2.6.4, while CLion, DataGrip, DataSpell, Rider, and RustRover receive different patch numbers. Gateway is fixed in versions like 2026.1.4, 2025.3.3, and 2025.2.6. Toolbox App fixes land in 3.9.1 and 3.8.2, and ReSharper updates include 2026.2.4, 2026.1.5.3, and 2025.3.5.3. Versions 2025.1 and earlier, and Toolbox App 3.7 and earlier, receive no fix and require moving to a supported release. Direct JBR users need builds jbr25.635.79, jbr25.508.41, jbr25.329.142, jbr21.1163.125, or jbr21.1038.91.
The runtime integrates Oracle fixes for CVE-2026-91403 and CVE-2026-114820, dropping trust in emSign ECC Root CA – G3, emSign Root CA – G1, emSign Root CA – G2, and AAA Certificate Services. Fixed 2025.3+ versions also pull Chrome certificate updates (CVE-2026-118696) for JCEF from Google's servers on startup.