All vulnerabilities
CVE-2026-75045

In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature

JetBrains YouTrack
Open in ThreatlineRecord JSON
CVSS
9.1Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.42%Chance of exploitation activity in the next 30 days, higher than 35% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2025.3.156085, 2026.1.13913, 2026.2.18112Fixed versionCVE List
Published17 Aug 2026Updated 18 Aug 2026CVE List

What fixes it

  • 2025.3.156085, 2026.1.13913, 2026.2.18112YouTrackCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 17 Aug 2026, 15:54 UTCPublishedCVE List
  2. 19 Oct 2026, 20:32 UTCExploit code publicGitHub proof-of-concept repositories

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Affected versions 1

  • YouTrackaffected: all versions before 2025.3.156085, 2026.1.13913, 2026.2.18112CVE List

References 1