PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-75055 JetBrains CVE debrief

CVE-2026-75055 is a medium-severity vulnerability in JetBrains IntelliJ IDEA before 2026.2.1, allowing local file reads via XXE in Hadoop ResourceManager. This vulnerability affects IntelliJ IDEA deployments using Hadoop ResourceManager, with potential operational impacts including local file reads via XXE attacks. Defenders should prioritize verification of exposure and assess the need for updates or compensating controls. The CVE record and vendor advisory provide primary sources for details.

Vendor
JetBrains
Product
IntelliJ IDEA
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-17
Original CVE updated
2026-09-11
Advisory published
2026-08-17
Advisory updated
2026-09-11

Who should care

Defenders responsible for IntelliJ IDEA deployments, especially those using Hadoop ResourceManager, should assess exposure and prioritize verification and remediation efforts.

Why it matters

CVE-2026-75055 is a medium-severity vulnerability in JetBrains IntelliJ IDEA before 2026.2.1, allowing local file reads via XXE in Hadoop ResourceManager. Defenders should prioritize verification of exposure, especially in deployments using Hadoop ResourceManager, and assess the need for updates or compensating controls.

  • Verification of exposure in IntelliJ IDEA deployments using Hadoop ResourceManager
  • Potential for local file reads via XXE attacks
  • Need for updates or compensating controls to mitigate vulnerability

Technical summary

CVE-2026-75055 is a vulnerability in JetBrains IntelliJ IDEA before version 2026.2.1, where the Hadoop ResourceManager could read local files via an XML External Entity (XXE) attack. This vulnerability affects IntelliJ IDEA deployments using Hadoop ResourceManager, and defenders should prioritize verifying exposure and assessing the need for updates or compensating controls.

Defensive priority

Defenders should prioritize verifying exposure in IntelliJ IDEA deployments, especially those using Hadoop ResourceManager, and assess the need for updates or compensating controls.

Recommended defensive actions

  • Verify IntelliJ IDEA version and ensure it is updated to 2026.2.1 or later
  • Assess exposure of Hadoop ResourceManager in IntelliJ IDEA deployments
  • Review and implement compensating controls if updates are not feasible

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability, with the vendor advisory being the primary source for details. Evidence is limited to publicly available sources, and defenders should verify exposure in IntelliJ IDEA deployments using Hadoop ResourceManager. The vendor advisory and CVE record provide source-grounded information, but additional details may be necessary for comprehensive risk assessment.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-75055 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-75055

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-75055 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-75055

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.