# JetBrains vulnerabilities & exploitation **CISA KEV** · **Ransomware** > As of 2026-10-05, Threadlinqs tracks 12 JetBrains CVEs, 1 in the CISA Known Exploited Vulnerabilities catalog, 1 used in ransomware campaigns, linked to 7 tracked threat campaigns and 9 named threat actors. **Data as of:** 2026-10-05 ## Exploitation timeline Threadlinqs has recorded 12 JetBrains CVEs published between 2024-03-15 and 2026-07-15. The busiest month was 2026-05 (6 new CVEs). 1 of them (8%) are listed in CISA KEV, which means exploitation in the wild has been confirmed. ## Most exploited vulnerabilities Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 12 of 12 tracked JetBrains CVEs. - [CVE-2024-27198](https://intel.threadlinqs.com/cve/CVE-2024-27198) — CRITICAL 9.8 · KEV · Ransomware · EPSS 93% · 2024-03-04 - [CVE-2024-27199](https://intel.threadlinqs.com/cve/CVE-2024-27199) — HIGH 7.3 · EPSS 82.5% · 2024-03-04 - [CVE-2026-63077](https://intel.threadlinqs.com/cve/CVE-2026-63077) — CRITICAL 9.8 · EPSS 0.6% · 2026-07-27 - [CVE-2026-49366](https://intel.threadlinqs.com/cve/CVE-2026-49366) — HIGH 7.8 · EPSS 0.5% · 2026-05-29 - [CVE-2026-25848](https://intel.threadlinqs.com/cve/CVE-2026-25848) — CRITICAL 9.1 · EPSS 0.4% · 2026-02-09 - [CVE-2026-49373](https://intel.threadlinqs.com/cve/CVE-2026-49373) — HIGH 7.1 · EPSS 0.4% · 2026-05-29 - [CVE-2026-53915](https://intel.threadlinqs.com/cve/CVE-2026-53915) — HIGH 7.1 · EPSS 0.3% · 2026-06-19 - [CVE-2026-49370](https://intel.threadlinqs.com/cve/CVE-2026-49370) — LOW 3.4 · EPSS 0.2% · 2026-05-29 - [CVE-2026-49374](https://intel.threadlinqs.com/cve/CVE-2026-49374) — HIGH 7.6 · EPSS 0.2% · 2026-05-29 - [CVE-2026-49376](https://intel.threadlinqs.com/cve/CVE-2026-49376) — MEDIUM 6.5 · EPSS 0.2% · 2026-05-29 - [CVE-2026-49369](https://intel.threadlinqs.com/cve/CVE-2026-49369) — MEDIUM 4.3 · EPSS 0.2% · 2026-05-29 - [CVE-2026-53914](https://intel.threadlinqs.com/cve/CVE-2026-53914) — MEDIUM 6.7 · EPSS 0.2% · 2026-06-26 ## Products affected Threadlinqs normalises CPE and CNA product records across all 12 CVEs; 6 distinct JetBrains products are affected. The most frequently affected: - Teamcity — 6 CVEs - YouTrack — 2 CVEs - GoLand — 1 CVE - Hub — 1 CVE - IntelliJ IDEA — 1 CVE - Kotlin — 1 CVE ## Threat activity 7 tracked threat campaigns reference JetBrains products or exploit JetBrains CVEs: - [Edge Infrastructure Under Siege: Tenable and SentinelOne Datasets Reveal Convergent Nation-State and Criminal Exploitation of Perimeter Devices](https://intel.threadlinqs.com/threat/TL-2026-2153) — HIGH — 2026-08-26 - [2026 Ransomware Surge Targeting US Organizations: Identity-First Compromise, BYOVD, and Living-Off-the-Cloud Exfiltration (Qilin, Akira, Clop, INC Ransom, Play, DragonForce, Sinobi)](https://intel.threadlinqs.com/threat/TL-2026-2125) — HIGH — 2026-08-23 - [CVE-2026-63077: Unauthenticated RCE in JetBrains TeamCity On-Premises via Agent Polling Protocol](https://intel.threadlinqs.com/threat/TL-2026-1747) — CRITICAL — 2026-07-28 - [FakeAgent Malvertising Campaign Distributes SectopRAT via Fake Claude Desktop Installer Hosted on claude.ai](https://intel.threadlinqs.com/threat/TL-2026-1669) — HIGH — 2026-07-24 - [Fake Claude Desktop App Promoted via Bing Ads Delivers SectopRAT (ArechClient2) Malware](https://intel.threadlinqs.com/threat/TL-2026-1662) — HIGH — 2026-07-23 - [Multiple JetBrains Product Vulnerabilities: Account Takeover, Privilege Escalation, and RCE Across Hub, YouTrack, IntelliJ IDEA, Kotlin, GoLand, and TeamCity](https://intel.threadlinqs.com/threat/TL-2026-1069) — HIGH — 2026-07-02 - [Storm-1175 Medusa Ransomware Zero-Day Exploitation Campaign (CVE-2026-23760, CVE-2025-10035)](https://intel.threadlinqs.com/threat/TL-2026-0326) — CRITICAL — 2026-04-06 ## Threat actors targeting JetBrains Named threat actors attributed to campaigns that involve JetBrains products or CVEs, with the number of linked campaigns: - [Akira](https://intel.threadlinqs.com/actor/Akira) — 1 campaign - [Clop](https://intel.threadlinqs.com/actor/Clop) — 1 campaign - [DragonForce](https://intel.threadlinqs.com/actor/DragonForce) — 1 campaign - [INC Ransom](https://intel.threadlinqs.com/actor/INC%20Ransom) — 1 campaign - [INC Ransom - G1032](https://intel.threadlinqs.com/actor/INC%20Ransom%20-%20G1032) — 1 campaign - [Play - G1040](https://intel.threadlinqs.com/actor/Play%20-%20G1040) — 1 campaign - [Sinobi](https://intel.threadlinqs.com/actor/Sinobi) — 1 campaign - [Storm-1175](https://intel.threadlinqs.com/actor/Storm-1175) — 1 campaign - [Storm-1567](https://intel.threadlinqs.com/actor/Storm-1567) — 1 campaign ## How to prioritise JetBrains patching This order follows the data Threadlinqs holds for JetBrains, not a generic severity checklist: - 1 of 12 JetBrains CVEs (8%) are in CISA KEV: treat them as actively exploited and remediate them first, starting with [CVE-2024-27198](https://intel.threadlinqs.com/cve/CVE-2024-27198). - 1 CVE is known to be used in ransomware campaigns; patch these ahead of other KEV entries on internet-facing systems. - Outside KEV, the highest EPSS scores are [CVE-2024-27199](https://intel.threadlinqs.com/cve/CVE-2024-27199) (82.5%), [CVE-2026-63077](https://intel.threadlinqs.com/cve/CVE-2026-63077) (0.6%), [CVE-2026-49366](https://intel.threadlinqs.com/cve/CVE-2026-49366) (0.5%). - 3 CVEs score Critical and 5 High on CVSS v3 (maximum 9.8, average 7.2); sequence these after KEV and high-EPSS items. ## About this data Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-05 and refresh daily. Canonical: https://intel.threadlinqs.com/vendors/jetbrains All vendors: https://intel.threadlinqs.com/vendors Full detection coverage and IOCs via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp