VulnSocial

CVE-2026-86480Disclosure

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-306

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 5 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 4 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • Peaked 2d ago at 2 mentions (2026-09-08); latest day: 1
  • 5 total mentions across 3 days

Deep dive

Activity timeline5 mentions / 3d
01122Mentions · 2026-09-08: 2Mentions · 2026-09-09: 2Mentions · 2026-09-24: 1Patch / Workaround · 2026-09-08: 2Patch / Workaround · 2026-09-09: 1Technical Details · 2026-09-08: 2Technical Details · 2026-09-09: 1Technical Details · 2026-09-24: 109-0809-0909-24
Signal classification3 categories
Disclosure
240.0%
Patch
240.0%
General
120.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-09-082
Disclosure1Patch1
2026-09-092
General1Patch1
2026-09-241
Disclosure1
Full discourse5 posts
  • Rıdvan Yağlı@ridvanyagli
    Disclosure

    🚨 JetBrains ürünlerinde 6 yeni güvenlik açığı: 2 kritik CVSS 9.8 JetBrains; YouTrack, Hub, IntelliJ IDEA ve GoLand ürünlerini etkileyen 6 güvenlik açığını giderdi. CVE-2026-86478 — CVSS 9.8 YouTrack Helpdesk'te hatalı kimlik doğrulama nedeniyle kimlik doğrulama gerektirmeden hesap ele geçirme mümkün. CVE-2026-86480 — CVSS 9.8 JetBrains Hub'da kimlik doğrulama olmadan trusted service kaydedilerek Superuser yetkisi elde edilebiliyor. Diğer açıklar: • CVE-2026-86502 — CVSS 8.4 — IntelliJ IDEA • CVE-2026-86479 — CVSS 8.1 — YouTrack • CVE-2026-86504 — CVSS 7.8 — IntelliJ IDEA • CVE-2026-86506 — CVSS 5.9 — GoLand ⚠️ Şu an için bu 6 açığın aktif olarak istismar edildiğine dair doğrulanmış bilgi yok. YouTrack, Hub, IntelliJ IDEA veya GoLand kullanıyorsanız, etkilenen sürümleri kontrol edip güvenlik güncellemelerini uygulayın.

    Post summary

    JetBrains disclosed six critical vulnerabilities across its products, released patches, and advised users to apply updates; no evidence of active exploitation has been reported.

    00041560
    2.4K followersView on X
  • CERT-PY@CERTpy
    General

    ⚠️ Vulnerabilidades en productos JetBrains ❗ CVE-2026-86502 ❗ CVE-2026-86482 ❗ CVE-2026-86480 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-jetbrains-4/ https://t.co/BXcZBkPHsX

    Post summary

    The tweet merely lists three new JetBrains CVEs and points to a link for further information; no exploitation, mitigation, or technical details are provided.

    02020235
    6.7K followersView on X
  • CCB Alert@CCBalert
    Patch

    Warning: Critical #JetBrains YouTrack & Hub flaws! #CVE-2026-86478 & #CVE-2026-86480 (CVSS: 9.8) allow unauthenticated attackers to hijack accounts & gain full superuser access. #Patch #Patch #Patch More info: https://www.jetbrains.com/privacy-security/issues-fixed/

    Post summary

    The tweet warns of two critical JetBrains YouTrack and Hub vulnerabilities, cites a high CVSS score, and directs users to a patching page.

    01000292
    7.2K followersView on X
  • SHELLCODE@sh3ll_c0d3
    Disclosure

    🚨 ZERO-DAY ALERT: JetBrains Hub unauthenticated superuser bug (CVE-2026-86480, CVSS 9.8)! Missing auth lets remote attackers register rogue services & seize CI/CD identity. 👉 Read the SentinelLabs breakdown: https://sh3llc0d3.com/blog/jetbrains-hub-zero-day-how-missing-auth-granted-remote-superuser-takeover-cve-2026-86480/ #sh3llc0d3 #shellcode #DevSecOps

    Post summary

    The tweet announces a zero-day vulnerability in JetBrains Hub (CVE-2026-86480, CVSS 9.8) involving an authentication bypass that enables remote superuser takeover of CI/CD identity, and directs readers to a SentinelLabs technical breakdown.

    0000079
    107 followersView on X
  • Upwind Security MDR@UpwindMDR
    Patch

    🚨Critical - JetBrains Hub Unauth Trusted Service Registration PrivEsc (CVE-2026-86480) JetBrains Hub exposes a critical trusted-service registration endpoint where the service trust flag can be set without authentication. An unauthenticated attacker can register a malicious trusted service, then obtain superuser privileges via elevated service-to-Hub permissions. Properly authenticated service registration flows are not impacted. 👉Affected: JetBrains Hub < 2026.2.52442 | Upgrade to 2026.2.52442

    Post summary

    JetBrains Hub exposes an unauthenticated trusted‑service endpoint that permits privilege escalation; upgrading to version 2026.2.52442 is the advised remediation.

    0000056
    304 followersView on X

Explore more

Back to dashboard