PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-86491 JetBrains CVE debrief

CVE-2026-86491 describes a stored XSS vulnerability in JetBrains YouTrack before version 2026.2.18634. The vulnerability could be exploited via project and organization icon uploads, potentially leading to XSS attacks on users of affected YouTrack instances. Defenders responsible for JetBrains YouTrack deployments should assess exposure and prioritize patching or upgrading to version 2026.2.18634 or later. The CVSS score is 3.5, indicating a low severity vulnerability. The CVE record and NVD entry provide limited information about the vulnerability, with the primary source being the JetBrains issue page.

Vendor
JetBrains
Product
YouTrack
CVSS
LOW 3.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-07
Original CVE updated
2026-09-07
Advisory published
2026-09-07
Advisory updated
2026-09-07

Who should care

Defenders responsible for JetBrains YouTrack deployments should assess exposure and prioritize patching or upgrading to version 2026.2.18634 or later.

Why it matters

CVE-2026-86491 is a stored XSS vulnerability in JetBrains YouTrack that could be exploited via project and organization icon uploads. Defenders responsible for JetBrains YouTrack deployments should assess exposure and prioritize patching or upgrading to version 2026.2.18634 or later.

  • Defenders need to verify the version of JetBrains YouTrack in use and assess exposure to this vulnerability
  • Exploitation of this vulnerability could lead to XSS attacks on users of the affected YouTrack instances

Technical summary

The vulnerability is a stored XSS issue in JetBrains YouTrack before version 2026.2.18634. It could be exploited via project and organization icon uploads, potentially leading to XSS attacks on users of affected YouTrack instances. The CVSS score is 3.5, indicating a low severity vulnerability. Defenders should prioritize verifying the version of JetBrains YouTrack in use and assessing exposure to this vulnerability.

Defensive priority

Defenders should prioritize verifying the version of JetBrains YouTrack in use and assessing exposure to this vulnerability.

Recommended defensive actions

  • Verify the version of JetBrains YouTrack in use
  • Assess exposure to this vulnerability
  • Apply the patch or upgrade to version 2026.2.18634 or later if vulnerable

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability, with the primary source being the JetBrains issue page. Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability. Defenders should verify the version of JetBrains YouTrack in use and assess exposure to this vulnerability.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-86491 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-86491

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-86491 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-86491

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.