eMudhra Certificate Authority Incident: Status and Guidance for JetBrains Products

JetBrains is responding to the industry-wide eMudhra Certificate Authority (CA) security incident, which affects certificate trust in a number of software products and development environments, including several JetBrains products. Our Security and product teams are working to address the impact and release security updates. We recommend that customers keep their JetBrains products, operating systems, and development environments up to date and follow the guidance below.

What Happened

On October 17, 2026, a security researcher reported that private keys associated with eight eMudhra intermediate certificate authorities could be recovered because of weaknesses in how they were generated.

These weaknesses could allow an attacker to create certificates that appear trusted by systems that continue to accept the affected certificate chains.

Browser and operating system vendors have taken steps to block the affected certificates. However, applications that use separate or bundled certificate trust stores may require additional updates.

JetBrains Impact

Our Security and product teams have been assessing the impact across the JetBrains product portfolio. We have identified that this incident affects multiple products, including our IDEs, Toolbox App, TeamCity, YouTrack, Hub, and other developer tools.

We are not aware of any exploitation of this issue against JetBrains customers.

Many JetBrains products, both desktop and on-premises as well as our cloud services, run on Java, including our IDEs, which use JetBrains Runtime (our build of the Java runtime). JetBrains Runtime, like other Java runtimes such as Oracle JDK, OpenJDK, and Amazon Corretto, trusted the affected certificates.

We are prioritizing remediation based on severity and potential customer impact and releasing updates as fixes become available.

Security Updates and Infrastructure Status

We are working on security updates for all affected distributable JetBrains products and tools. The table below shows which updates are already available and which are still in progress.

For JetBrains cloud services, we are updating our cloud services and infrastructure on an ongoing basis, including JetBrains Air, Qodana Cloud, TeamCity Cloud, YouTrack Cloud, Datalore and JetBrains AI services. For these services, no action is required from customers. One exception: TeamCity Cloud customers who use self-hosted build agents should check the Java runtime on those agents and update it if needed.

Our teams are continuing remediation work across other affected products. We will update this post with product-specific guidance as fixes become available.

What Customers Should Do

We recommend that customers take the following steps:

Install available JetBrains security updates. Update affected products to the latest patched versions as they become available.

Keep operating systems and runtimes updated. Apply the latest security updates from operating system and runtime vendors, including certificate trust store updates. For additional technical guidance, see the eMudhra incident recommendations for developers.

Follow product-specific guidance. For products where security updates are not yet available, follow the recommended mitigation steps provided in JetBrains security advisories and product documentation.

If you cannot update the product right now, update the Java runtime it uses. If that is not possible either, remove the two root certificates at the top of all affected chains, emSign ECC Root CA – G3 and AAA Certificate Services, from that Java runtime’s trust store, or point the product to a copy of the trust store without them. Also update your OS ca-certificates package, since many tools trust the system certificate store too.

Disabling certificate validation altogether or otherwise weakening the certificate verification mechanisms as a workaround is NOT recommended.

What’s Next

Our security and product teams are continuing to review certificate trust across affected JetBrains products and preparing additional security updates where needed.

We will update this post as fixes become available and publish version-specific guidance through our product release notes and security advisories.