eMudhra Certificate Authority Incident: Status and Guidance for JetBrains Products

October 30, 2026

JetBrains is responding to the industry-wide eMudhra Certificate Authority (CA) security incident, which affects certificate trust in a number of software products and development environments, including several JetBrains products. Our Security and product teams are working to address the impact and release security updates. We recommend that customers keep their JetBrains products, operating systems, and development environments up to date and follow the guidance below.

**What Happened**

On October 17, 2026, a security researcher reported that private keys associated with eight eMudhra intermediate certificate authorities could be recovered because of weaknesses in how they were generated.

These weaknesses could allow an attacker to create certificates that appear trusted by systems that continue to accept the affected certificate chains.

Browser and operating system vendors have taken steps to block the affected certificates. However, applications that use separate or bundled certificate trust stores may require additional updates.

**JetBrains Impact**

Our Security and product teams have been assessing the impact across the JetBrains product portfolio. We have identified that this incident affects multiple products, including our IDEs, Toolbox App, TeamCity, YouTrack, Hub, and other developer tools.

We are not aware of any exploitation of this issue against JetBrains customers.

Many JetBrains products, both desktop and on-premises as well as our cloud services, run on Java, including our IDEs, which use JetBrains Runtime (our build of the Java runtime). JetBrains Runtime, like other Java runtimes such as Oracle JDK, OpenJDK, and Amazon Corretto, trusted the affected certificates.

We are prioritizing remediation based on severity and potential customer impact and releasing updates as fixes become available.

**Security Updates and Infrastructure Status**

We are working on security updates for all affected distributable JetBrains products and tools. The table below shows which updates are already available and which are still in progress.

ProductStatusFixed inWhat you should do JetBrains IDEs (IntelliJ-based), Gateway Fixed Latest bugfix update for 2025.2–2026.3, see IDEs blogpostUpdate. For 2025.1 and earlier, upgrade to a supported version or apply the workaround from IDEs blogpost Toolbox App Fixed 3.8.2, 3.9.1, see IDEs blogpostUpdate the Toolbox App. For 3.7 and earlier, upgrade to 3.9 or apply the workaround from IDEs blogpost Rider, ReSharper Fixed Latest bugfix update for 2025.2–2026.3, see IDEs blogpostUpdate. For 2025.1 and earlier, upgrade to a supported version. JetBrains Runtime (JBR)Fixed JBR 25: 25.0.4.1b635.79, 25.0.4.1b508.41, 25.0.4.1b329.142. JBR 21: 21.0.11b1163.125, 21.0.9b1038.91.

See GitHub releasesJetBrains IDEs bundle JBR, so updating the IDE is enough. If you use JBR directly, update to the latest build of your JBR line. TeamCity Fix in progress Updating TeamCity alone may not update Java. Check the Java runtime on every server node and build agent, including self-hosted agents of TeamCity Cloud, and update it if needed, then restart. Please check user-uploaded certificates.

For Docker, deploy the updated images when they are published and recreate the containers.

You can also patch existing images using these instructions.

Detailed instructions will follow in a separate blog post. YouTrack Fixed YouTrack Server 2026.2.19728, 2026.1.14165 and 2025.3.172487. Latest Docker images jetbrains/youtrack and jetbrains/youtrack-windows.Update to the fixed build of your version. If you use 2025.2 or earlier, upgrade to 2025.3 or later. Hub Fixed2026.2.52556Update to the fixed version. Qodana Partially fixedQodana Self-Hosted 1.49.0 and installer 0.1.26. Not fixed yet: linter images (2026.2 and older) and Qodana CLI (2026.2.2)Self-Hosted: update to 1.49.0 or later. Linters and CLI: update when fixed versions are published. Datalore Fixed2026.4.1Update to the fixed version. Junie CLI Fixed26.10.27 (3893.6)Update to 26.10.27 or later. Kotlin (CLI, LSP, Gradle plugin, and Ktor CLI)Fix in progress Kotlin Gradle plugin 2.5.0 (upcoming)

Kotlin Toolchain 0.14.0 (upcoming)Kotlin Gradle plugin downloads Node.js 24.16.0 by default for Kotlin/JS and Kotlin/Wasm builds. Set Node.js 24.22.1 or later explicitly in your Gradle build script, see Change Node.js version.

If you use the Node.js toolchain service, first set _kotlin.js.nodeJsToolchainMode=disable_ in _gradle.properties_.

Update the Java runtime you use. IDE Services Fix in progress Update when the fixed version is available. MPS Fix in progress Upcoming bugfix updates for MPS 2025.1–2026.1 and MPS 2026.2 RC2 Update MPS when the fixed versions are available. If you build your own IDE based on MPS, rebuild it on the fixed MPS version so that it gets the updated Java runtime and embedded browser.

For older MPS versions, remove the two root certificates from the bundled Java runtime as described below. JetBrains Central CLI, JetBrains Context CLI Fix in progress Update when the fixed version is available.

For JetBrains cloud services, we are updating our cloud services and infrastructure on an ongoing basis, including JetBrains Air, Qodana Cloud, TeamCity Cloud, YouTrack Cloud, Datalore and JetBrains AI services. For these services, no action is required from customers. One exception: TeamCity Cloud customers who use self-hosted build agents should check the Java runtime on those agents and update it if needed.

Our teams are continuing remediation work across other affected products. We will update this post with product-specific guidance as fixes become available.

**What Customers Should Do**

We recommend that customers take the following steps:

Install available JetBrains security updates. Update affected products to the latest patched versions as they become available.

Keep operating systems and runtimes updated. Apply the latest security updates from operating system and runtime vendors, including certificate trust store updates. For additional technical guidance, see theeMudhra incident recommendations for developers.

Follow product-specific guidance. For products where security updates are not yet available, follow the recommended mitigation steps provided in JetBrains security advisories and product documentation.

If you cannot update the product right now, update the Java runtime it uses. If that is not possible either, remove the two root certificates at the top of all affected chains, emSign ECC Root CA – G3 and AAA Certificate Services, from that Java runtime’s trust store, or point the product to a copy of the trust store without them. Also update your OS ca-certificates package, since many tools trust the system certificate store too.

Disabling certificate validation altogether or otherwise weakening the certificate verification mechanisms as a workaround is NOT recommended.

**What’s Next**

Our security and product teams are continuing to review certificate trust across affected JetBrains products and preparing additional security updates where needed.

We will update this post as fixes become available and publish version-specific guidance through our product release notes and security advisories.

[](https://blog.jetbrains.com/security/2026/10/emudhra-certificate-authority-incident-status-and-guidance-for-jetbrains-products/#)

1. What Happened
2. JetBrains Impact
3. Security Updates and Infrastructure Status
4. What Customers Should Do
5. What’s Next

Discover more