CVE-2019-9186 describes a critical remote code execution vulnerability in several versions of JetBrains IntelliJ IDEA. The flaw stems from Spring Boot run configurations, which, by default, allowed a JMX server to listen on all network interfaces instead of only localhost. This misconfiguration enabled unauthenticated remote attackers to execute arbitrary code on systems running affected IntelliJ IDEA configurations. The vulnerability carries a CVSS v3.0 score of 9.8 (Critical), indicating a high-impact threat with a network attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. While no public exploit intelligence (Metasploit, Nuclei, ExploitDB) is currently available, and there is minimal community discussion or media coverage, the potential for severe impact remains. JetBrains has released patches for this issue in IntelliJ IDEA versions 2019.1, 2018.3.4, 2018.2.8, 2018.1.8, and 2017.3.7. Organizations using affected versions should prioritize updating to a patched release to mitigate this critical risk.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 2018.1, < 2018.1.8CPE matchmatch criteria | cpe:2.3:a:jetbrains:intellij_idea:*:*:*:*:*:*:*:* | ||
>= 2018.2, < 2018.2.8CPE matchmatch criteria | cpe:2.3:a:jetbrains:intellij_idea:*:*:*:*:*:*:*:* | ||
>= 2018.3, < 2018.3.5CPE matchmatch criteria | cpe:2.3:a:jetbrains:intellij_idea:*:*:*:*:*:*:*:* | ||
>= 2018.3.6, < 2019.1CPE matchmatch criteria | cpe:2.3:a:jetbrains:intellij_idea:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.