CVE-2026-86488 JetBrains CVE debrief

Who should care

Defenders responsible for JetBrains YouTrack deployments should assess their exposure to this vulnerability, especially if using versions prior to 2026.2.18634. Security teams and administrators should verify their configurations and consider updating to the latest version.

Why it matters

CVE-2026-86488 is a medium-severity vulnerability in JetBrains YouTrack that exposes private saved searches. Defenders should care because it may allow unauthorized access to sensitive information. Relevant roles include security teams and administrators responsible for YouTrack deployments. Supported consequences include potential data exposure and the need for configuration verification and updates. Evidence limits include reliance on limited CVE and NVD information, with primary details from a JetBrains source reference.

• Potential unauthorized access to private saved searches
• Need to verify YouTrack deployment configurations and versions
• Possible data exposure through watchRules and issueListConfig endpoints
• Requires updating to version 2026.2.18634 or later for fix

Technical summary

CVE-2026-86488 is a medium-severity vulnerability in JetBrains YouTrack before version 2026.2.18634. The vulnerability exposes private saved searches through the watchRules and issueListConfig endpoints, potentially allowing unauthorized access to sensitive information.

Defensive priority

Defenders should prioritize verifying exposure in their YouTrack deployments, especially those using versions before 2026.2.18634, and assess the effectiveness of their current security controls.

Recommended defensive actions

• Verify YouTrack deployment versions and configurations to ensure they are not exposed to the watchRules and issueListConfig endpoints.
• Assess the effectiveness of current security controls in preventing unauthorized access to private saved searches.
• Update YouTrack to version 2026.2.18634 or later if currently using an earlier version.

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability, with the primary details coming from the JetBrains source reference.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.