All vulnerabilities
CVE-2026-86478

In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address

JetBrains YouTrack
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.61%Chance of exploitation activity in the next 30 days, higher than 48% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2025.3.161254, 2026.1.14042Fixed versionCVE List
Published7 Sep 2026Updated 9 Sep 2026CVE List

What fixes it

  • 2025.3.161254, 2026.1.14042YouTrackCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 7 Sep 2026, 16:26 UTCPublishedCVE List
  2. 21 Oct 2026, 23:29 UTCExploit code publicGitHub proof-of-concept repositories

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Affected versions 1

  • YouTrackaffected: all versions before 2025.3.161254, 2026.1.14042CVE List

References 1