CVE-2026-118697: JetBrains Toolbox and IDE Trust Remediation

CVE-2026-118697 is JetBrains’ product response to the 2026 eMudhra intermediate-certificate compromise. It affects JetBrains Toolbox App and multiple IDE families because the jetbrainsd background service could trust the compromised intermediates. The reader task is therefore not simply “remove a certificate.” Teams must identify which JetBrains product installed or invokes the daemon, deploy the correct fixed product release, restart the relevant process or desktop session, and verify the running state.

This CVE shares an incident timeline with certificate-validation findings in other ecosystems, but it is not an alias for the Python, Go, Java or Red Hat identifiers. Each ecosystem has a different artifact, version boundary and activation path. Use the CVE Record ve JetBrains security advisory as the controlling sources for JetBrains endpoints.

Bu vendor advisory identifies the daemon correction as jetbrainsd 0.9.9728. The table below lists selected current product branches; older maintained branches and preview builds have their own mappings in that advisory.

Fixed JetBrains releases

Do not apply one IDE’s threshold to another product. JetBrains issued different maintenance builds for several product lines, and a fleet can contain side-by-side IDE versions installed manually, by Toolbox, through a package manager, or in a remote development image.

Why an operating-system CA update is not sufficient

The vulnerable decision belongs to JetBrains product behavior around the daemon and its trust material. A system CA update may be necessary for the wider certificate incident, but it does not prove that the JetBrains application, bundled components or active daemon were updated and restarted. Likewise, updating an IDE icon in the desktop launcher does not establish that an older Toolbox-managed installation or remote development backend is no longer in use.

Track three distinct layers:

Discover endpoints and build systems

Inventory developer laptops, shared workstations, VDI images, remote development hosts, CI workers, build containers and golden images. Do not limit the query to employees who actively open an IDE: Toolbox and background services can remain installed after a product is no longer routinely used.

Use platform-native software inventory first. On authorized endpoints, supplement it with read-only process and filesystem checks. Paths vary by operating system and installation method, so treat the examples as discovery aids rather than universal locations.

# Linux: locate an active daemon and capture its executable
pgrep -af jetbrainsd
for pid in $(pgrep jetbrainsd 2>/dev/null); do
  readlink -f "/proc/$pid/exe"
done

# macOS: process and application inventory
pgrep -alf jetbrainsd
mdfind "kMDItemCFBundleIdentifier == 'com.jetbrains.toolbox'"

# Windows PowerShell: signed process path and installed-product clues
Get-CimInstance Win32_Process -Filter "Name='jetbrainsd.exe'" |
  Select-Object ProcessId, ExecutablePath, CommandLine

Do not collect command lines broadly if they can contain project secrets or tokens. Limit collection to the process fields needed for product attribution and handle endpoint telemetry under the organization’s privacy and retention policy.

Remediation workflow

1. Map every product and installation path to the JetBrains fixed-version table.
2. For CVE-2026-118697, install and start a fixed Toolbox App or IDE that includes jetbrainsd 0.9.9728. JetBrains states that one daemon copy runs per user and a newer copy replaces the older one. Updating one qualifying app can therefore repair the shared daemon for that user.
3. Check each IDE separately for the related JBR and JCEF trust issues; the daemon correction does not prove those other components are repaired.
4. Update remote development backends and golden images, not only interactive laptops.
5. Restart jetbrainsd, the IDE, the desktop session, or the endpoint as required by the supported vendor workflow.
6. Verify the active daemon path and version 0.9.9728 or later after activation. Record the product and user context that delivered it.
7. Remove or quarantine obsolete vulnerable installations so launchers and automation cannot reactivate them.
8. Preserve the earlier state for incident response when suspicious certificate or network activity exists.

Keep the certificate incident as linked work items

A single eMudhra incident can generate multiple findings: Python runtime trust, Go binaries that must be rebuilt, Java trust stores, Red Hat packages, JetBrains endpoints and cloud-service trust policy. Link those findings to one incident timeline, but do not close them as a group. Each item needs its own affected asset, fixed artifact, activation requirement and verification evidence.

For JetBrains, closure should include the product name, old and new versions, installation path, update source, active daemon path, restart time and endpoint identifier. If the vulnerable state overlapped suspicious outbound connections or certificate errors, route the endpoint to incident response rather than treating the version upgrade as proof that the earlier window was clean.

Sonuç

CVE-2026-118697 is a JetBrains product and daemon remediation task inside a larger certificate incident. Update the exact Toolbox and IDE products, prove that jetbrainsd and active sessions use corrected binaries, and keep other ecosystems as separately verifiable work items. A system CA change or an IDE download without activation evidence is not sufficient closure.