The JetBrains
The JetBrains订阅

Compromised eMudhra Certificates: Update Your JetBrains IDEs, ReSharper, .NET Tools, Toolbox App, and Gateway Now

6

Summary

  • The private keys of eight eMudhra intermediate certificates were compromised. A network attacker could use them to impersonate websites and services that JetBrains tools connect to.
  • JetBrains IDEs, the Toolbox App, Gateway, and ReSharper are affected because they use the trust store of the bundled JetBrains Runtime (JBR). For IDEs, the embedded browser (JCEF) is also affected. Operating system updates don’t protect against this issue.
  • The Toolbox App and JetBrains IDEs use a background service, jetbrainsd. It has its own built-in list of trusted certificates and is fixed separately, in jetbrainsd 0.9.9728.
  • At the time of publishing, we are not aware of any exploitation of this issue against JetBrains users.

Available fixed versions

The issue is fixed in the following versions:

  • IntelliJ IDEA: 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.4.
  • PyCharm: 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.3.
  • PhpStorm: 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.3.
  • RubyMine: 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.3.
  • WebStorm: 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.3.
  • Rider: 2026.3 EAP 9, 2026.2.4, 2026.1.5.3, 2025.3.5.3.
  • CLion: 2026.3 RC, 2026.2.4.1, 2026.1.5.2, 2025.3.6.3, 2025.2.6.3.
  • DataSpell: 2026.1.3.1, 2025.3.3.1, 2025.2.4.1.
  • DataGrip: 2026.3 RC, 2026.2.6.1, 2026.1.4.1, 2025.3.6.1, 2025.2.6.1.
  • GoLand: 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.5.2, 2025.2.6.3.
  • RustRover: 2026.3 EAP 8, 2026.2.5, 2026.1.4.1, 2025.3.7.1, 2025.2.6.1.
  • Gateway: 2026.3 RC, 2026.2.4, 2026.1.4, 2025.3.3, 2025.2.6.
  • ReSharper: 2026.3 EAP9, 2026.2.4, 2026.1.5.3, 2025.3.5.3.
  • Toolbox App 3.9.1, 3.8.2.

The 2025.2.6.* updates for all IDEs now contain only the JBR fix. They will get a separate hotfix for the JCEF problem. Until then, use a workaround to disable JCEF in your IDE (see instructions below).

IDE versions 2025.1 and earlier, and Toolbox App 3.7 and earlier, will not receive this fix. You must update to a fixed version.

Details

In October 2026, the private keys of eight intermediate certificates issued by the certificate authority eMudhra were compromised. An attacker who can intercept your network traffic could use them to impersonate websites and services.

Full details of the incident.

JetBrains IDEs check certificates against the trust store of their bundled runtime, JetBrains Runtime (JBR), so updating your operating system doesn’t protect against this issue. We’ve integrated Oracle’s fixes for CVE-2026-91403 and CVE-2026-114820 into JBR as-is. The updated runtime blocks the compromised certificates and no longer trusts these root certificates:

  • emSign ECC Root CA – G3
  • emSign Root CA – G1
  • emSign Root CA – G2
  • AAA Certificate Services

In the fixed versions of 2025.3 and later, the embedded browser now receives Chrome’s certificate updates, which block the compromised certificates (CVE-2026-118696). It downloads them from Google’s update servers shortly after the IDE starts. If your network blocks access to Google’s update servers, the embedded browser stays unprotected. In this case, turn it off as described below.

The Toolbox App and JetBrains IDEs also install a background service, jetbrainsd. Its list of trusted certificates is built into the service itself, so updating JBR doesn’t fix it. We’ve released a separate fix in jetbrainsd 0.9.9728, tracked as CVE-2026-118697. Only one copy of jetbrainsd runs for each user, and a newer version always replaces an older one. Updating any app that includes jetbrainsd 0.9.9728 fixes it for all JetBrains apps.

What you should do: Update now

The fix is available in the latest versions of JetBrains IDEs, from 2025.2 up to 2026.3 RC. The upcoming 2026.3 release will include it too. Updating to the latest bugfix release of your current version is enough. Versions 2025.1 and earlier will not receive a fix. If you use one of them, please update to one of the versions above.

If you use ReSharper or other JetBrains .NET tools, update them to the latest version.

Important for Toolbox App users: versions 3.7 and earlier won’t receive this fix. If you’re on 3.7, update to version 3.9.1 or 3.8.2.

If you use JetBrains Gateway, update it to one of the following versions: 2026.1.4, 2025.3.3, 2025.2.6.

If you use JetBrains Runtime directly, update to one of the fixed builds: jbr25.635.79, jbr25.508.41, jbr25.329.142, jbr21.1163.125, jbr21.1038.91.

In rare cases, the IDE will no longer connect to a server whose certificate chains to one of the removed root certificates. The server’s owner will need to replace the certificate.

If you can’t update right away

Clean your certificates manually

The Java runtime bundled with these IDEs and Toolbox App still trusts two eMudhra-related root certificates. If you can’t update the IDE, give it a cleaned copy of its certificate list and turn off its built-in browser, which has its own list that can’t be changed. It takes about five minutes and is fully reversible.

  1. Copy the certificate list from the IDE folder to your home folder:
    macOS: .app/Contents/jbr/Contents/Home/lib/security/cacerts
    Windows / Linux: /jbr/lib/security/cacerts
  2. Remove the two affected roots, using the keytool in the IDE’s jbr/bin folder:
    keytool -delete -keystore -storepass changeit -alias "comodoaaaca [jdk]"
    keytool -delete -keystore -storepass changeit -alias "emsigneccrootcag3 [jdk]"
  3. Open Help | Edit Custom VM Options, add this line, then restart the IDE:
    -Djavax.net.ssl.trustStore=
    Important: write the full path, with no ~, no variables, and no quotes. A wrong path silently leaves you unprotected.
  4. In Settings | Tools | Server Certificates, make sure “Accept non-trusted certificates automatically” is off.
  5. Linux only: update the ca-certificates package.

What to expect: If the IDE shows an “untrusted server certificate” dialog for an eMudhra certificate, click Reject.

Disable JCEF in your IDE

To workaround the JCEF problem in 2025.2.6.4 and previous versions, or in any version if your network blocks Google’s update servers:

  1. Open Search Everywhere -> Actions
  2. Type “Registry”
  3. Open Registry
  4. Search for ‘ide.browser.jcef.enabled’ key
  5. Switch it off
  6. Restart

Note: Turning off the embedded browser affects features that use it, for example, Markdown and HTML previews and Jupyter notebook output. Some plugins may also stop working correctly. After you update to a fixed version, turn ide.browser.jcef.enabled back on and restart the IDE.

Update jetbrainsd background service

The Toolbox App and JetBrains IDEs use a background service, jetbrainsd. It has its own built-in list of trusted certificates, so updating JBR doesn’t fix it, and the workarounds above don’t apply to it.

The fix is in jetbrainsd 0.9.9728. You get it when you install or update a fixed version of the Toolbox App or an IDE and start it. Only one copy of jetbrainsd runs for each user, and the newest version replaces older ones. So updating the Toolbox App fixes jetbrainsd for all your IDEs, even if you can’t update the IDEs themselves.

If you can’t update the Toolbox App or an IDE, update jetbrainsd manually:

  1. Download the archive for your platform and check its SHA-256 checksum with shasum -a 256 (macOS), sha256sum (Linux), or Get-FileHash (Windows PowerShell):
  2. Unpack the archive and run jetbrainsd once without arguments. It replaces the older version. To unpack, use tar -xzf. On Windows 10 and later, tar is built in.
    • Linux: ./jetbrainsd/bin/jetbrainsd
    • macOS: ./jetbrainsd.app/Contents/MacOS/jetbrainsd
    • Windows: .\jetbrainsd\bin\jetbrainsd.exe
  3. Check the installed version. It should be 0.9.9728 or later:
    • Linux: "${XDG_DATA_HOME:-$HOME/.local/share}/JetBrains/Daemon/bundles/current/jetbrainsd/bin/jetbrainsd" --version
    • macOS: "$HOME/Library/Application Support/JetBrains/Daemon/bundles/current/jetbrainsd.app/Contents/MacOS/jetbrainsd" --version
    • Windows (PowerShell): & "$env:LOCALAPPDATA\JetBrains\Daemon\bundles\current\jetbrainsd\bin\jetbrainsd.exe" --version

Also check

Your project JDKs and any tools that bring their own runtime, such as Node.js, Python, or Go, use their own trust stores. Update them as their vendors recommend.

Support

If you have any questions about this issue or have trouble updating, please contact our Support team.

参与讨论