CVE-2026-75058

Executive Summary

CVE-2026-75058 is an XML External Entity (XXE) vulnerability in the Eclipse settings importers of JetBrains IntelliJ IDEA, affecting all versions prior to 2026.2.1. The flaw allows a locally delivered, attacker-crafted Eclipse settings file to trigger resolution of external XML entities when imported by a developer, resulting in disclosure of local files readable by the IDE process (high confidentiality impact, no integrity or availability impact). The vulnerability is rated CVSS 5.5 (Medium); no public exploit code, PoC, or in-the-wild exploitation has been confirmed at the time of this report, and the vulnerability is not listed in CISA KEV.

Technical Analysis

The NVD description states: "In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers." The token "xXE" is a typographical variant of "XXE" (XML External Entity), and the assigned CWE-611 (Improper Restriction of XML External Entity Reference) confirms the vulnerability class.

The attack surface is the Eclipse settings import feature: functionality that reads Eclipse IDE workspace/project preference files and converts them into IntelliJ IDEA configuration during import operations. When the importing XML parser processes a crafted settings document that contains a DOCTYPE declaration with external entity definitions, and entity references are subsequently expanded in the document body, the parser resolves the SYSTEM identifier. A SYSTEM identifier can reference a local resource via a file:/// URI, or an internal/attacker-controlled resource via http:///https://. Because entity expansion occurs inside the IDE process, the read operation runs with the privileges of the logged-in developer account.

The NVD description does not disclose the specific parser class, the exact file formats accepted, the importer code paths, or the fuzzing/analysis technique used to identify the flaw. Accordingly, implementation-level details such as function names, preference file syntax, and the precise conversion routine cannot be confirmed and are not asserted in this report. The analysis here is therefore based on the established behavior of CWE-611 and the known function of the Eclipse settings importers.

The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) defines the operational constraints precisely:

• Attack Vector (Local): The malicious settings file must be present on or delivered to the victim's workstation; the flaw cannot be triggered remotely without user-mediated file import.
• Attack Complexity (Low): No special conditions or race conditions are required to trigger entity expansion.
• Privileges Required (None): The attacker does not need an account on the target; crafting a malicious file and delivering it is sufficient.
• User Interaction (Required): The victim must perform an action — opening or importing the malicious Eclipse settings file in the IDE.
• Scope (Unchanged): The compromise is confined to the IDE process/security context; no boundary crossing into other components is scored.
• Confidentiality (High): Arbitrary local files readable by the developer account can be disclosed. Integrity and Availability are scored None, meaning the vulnerability is not a code-execution or denial-of-service primitive on its own.

Exploitation Scenarios

No public PoC is available for CVE-2026-75058; the attack chain below is inferred from the vulnerability class (CWE-611) and the attack vector data. It should be treated as a representative chain, not a confirmed exploit implementation.

Step 1 — Reconnaissance and target identification. The attacker selects a software developer or organization known to use JetBrains IntelliJ IDEA builds prior to 2026.2.1. Target identification can occur through public developer profiles, repository metadata, open-source contributor activity, or internal reconnaissance if the attacker already has limited foothold. Delivery leverages the developer's existing workflow: malicious content can be packaged inside a shared project archive, a "team settings" bundle, a workspace template, a plugin companion file, or a distribution channel such as a compromised repository, forum attachment, or messaging platform.

Step 2 — Triggering the specific flaw class. The crafted Eclipse settings file embeds a Document Type Definition (DTD) that declares an external entity. A canonical XXE construction at the vulnerability-class level is:

<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>

When the victim imports the Eclipse settings via the IDE's import facility, the vulnerable XML parser validates/processes the DTD and resolves the SYSTEM identifier. The parser then substitutes the entity reference with the contents of the referenced resource during document processing. Because the NVD description does not specify which exact settings file or parser path is affected, the payload type, extension, and required location (e.g., project .settings folder versus a standalone preferences export) cannot be confirmed.

Step 3 — Payload and execution method. The external entity can reference:

• A local file URI (file:///...) to read arbitrary files on the developer's machine.
• An HTTP(S) URI to perform server-side requests from the IDE's network context (SSRF), or to exfiltrate data to an attacker-controlled endpoint if a second external entity is chained to embed the file contents into an outbound request.

Data disclosure may manifest in the imported setting values, IDE log files, error messages, or generated workspace configuration — any output stream that receives the parser's substituted entity content.

Step 4 — Post-exploitation impact. The attacker obtains the contents of files accessible to the developer account. High-value targets on a developer workstation typically include IDE configuration and credential stores, private SSH keys, cloud provider tokens and API keys, source code not yet committed, environment configuration with database passwords, browser-synced secrets, and corporate document repositories mounted on the local filesystem. These credentials and secrets can then be reused for lateral movement, source-code exfiltration, or supply-chain compromise. The CVSS scoring (Integrity and Availability: None) indicates no direct write or denial-of-service capability from this vulnerability alone.

Impact Assessment

Business impact. The primary impact is confidentiality loss on developer workstations. A successful XXE against the Eclipse settings importer exposes local files to an attacker who can already deliver a file to the victim and induce them to import it. In enterprise environments, developer machines are high-value targets because they hold source code, build signing keys, cloud credentials, and access to CI/CD pipelines. Even though the CVSS base score is 5.5 (Medium), the downstream risk of credential theft and source-code disclosure can be significant in organizations with weak egress controls or poor credential hygiene.

Affected systems. JetBrains IntelliJ IDEA all versions before 2026.2.1. The vulnerability is present in the IDE itself, so no server infrastructure is directly affected; the blast radius is per-developer-workstation rather than network-wide. The Eclipse settings importer is exercised when onboarding Eclipse projects or importing workspace preferences, meaning the attack vector aligns with common developer workflows and is therefore realistic in real-world environments.

CVSS considerations. The vector decomposes as follows: local attack vector, low complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, and no integrity or availability impact. The high confidentiality subscore drives the 5.5 score; the requirement for user interaction and local delivery prevents a higher rating. EPSS has not yet scored this CVE; no probability-of-exploitation data is available. CISA KEV does not list CVE-2026-75058, and no threat-actor campaign has been publicly attributed to this CVE.

Detection Guidance

The following detection content targets the XXE payload class and the expected post-import behavior of the IDE. Because no public exploit exists and the CNA/NVD descriptions lack parser-level detail, these rules are status "experimental" and should be tuned against baseline traffic and file-creation behavior in your environment. Rules that depend on file content require content-aware telemetry (EDR file inspection, Sysmon with content capture, or similar).

Sigma Rule

title: IntelliJ IDEA Eclipse Settings Importer - XXE Payload File Creation (CVE-2026-75058)
id: 3f8a1c4e-9b21-4f6d-8a5c-1e7f3a9b0d2c
status: experimental
description: >
  Detects creation of Eclipse preference/XML files containing XML External Entity
  declarations consistent with CVE-2026-75058, associated with the JetBrains
  IntelliJ IDEA process. Requires file content telemetry (EDR or Sysmon with
  content capture). File extensions are inferred from the general Eclipse settings
  format; the NVD description does not enumerate exact extensions.
author: Valters IT Threat Intelligence
logsource:
  product: windows
  category: file_event
detection:
  selection:
    Image|endswith:
      - '\idea64.exe'
      - '\idea.exe'
    TargetFilename|endswith:
      - '.prefs'
      - '.xml'
  keywords_content:  # Content inspection layer, if available
    - '<!ENTITY'
    - 'SYSTEM'
    - 'file:///'
  condition: selection and keywords_content
fields:
  - Image
  - TargetFilename
  - User
falsepositives:
  - Legitimate XML preference files using DOCTYPE declarations (rare)
level: medium
tags:
  - attack.t1204
  - cve.2026-75058
  - cwe.611

YARA Rule

rule CVE_2026_75058_XXE_Eclipse_Settings
{
    meta:
        author      = "Valters IT Threat Intelligence"
        description = "Detects XXE payloads targeting JetBrains IntelliJ IDEA Eclipse settings importers (CVE-2026-75058)"
        cve         = "2026-75058"
        cwe         = "611"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-75058"
        date        = "2026-06-01"
    strings:
        $doctype = /<!DOCTYPE\s+[A-Za-z_][A-Za-z0-9_.:-]*\s*\[/i
        $entity  = /<!ENTITY\s+[A-Za-z_][A-Za-z0-9_]*\s+SYSTEM\s+["'][^"']+["']/i
        $file    = /file:\/\/\/[A-Za-z0-9_\-.\/:\\]+/i
        $http    = /SYSTEM\s+["']https?:\/\/[^"']+/i
    condition:
        $doctype and $entity and ($file or $http)
}

Suricata IDS Rule

Network detection targets the exfiltration/SSRF leg of the attack, where the IDE's XML parser makes an outbound HTTP request carrying or triggered by an entity declaration. Because the import event itself is local, network visibility is most useful for identifying the resulting request stream.

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-75058 - Attempted XXE Exfiltration Referencing file:// from IntelliJ IDEA"; flow:to_server,established; content:"<!ENTITY"; nocase; http.request_body; content:"SYSTEM"; nocase; http.request_body; distance:0; content:"file:///"; nocase; http.request_body; distance:0; sid:202675058; rev:1; classtype:attempted-user-admin; metadata:cve CVE-2026-75058, mitre_attack T1204;)

Elastic Detection

The following EQL correlation flags an IDE process that creates/imports settings files and shortly afterward initiates outbound HTTP(S) connections — a pattern consistent with XXE-triggered SSRF or exfiltration.

sequence by user.name, process.name with maxspan=5m
  [ file where event.action in ("creation", "modification") and
      process.name in ("idea64.exe", "idea", "idea.sh") and
      (file.extension == "prefs" or file.extension == "xml") ]
  [ network where process.name in ("idea64.exe", "idea", "idea.sh") and
      network.protocol in ("http", "https") and
      network.direction == "egress" ]

Tune by excluding known IDE update hosts and internal allowlisted services; the sequence is intentionally broad because the exact exfiltration endpoint is unknown.

Splunk SPL Query

(index=windows OR index=endpoint OR index=proxy)
(source="*.prefs" OR source="*.xml" OR sourcetype="xml*" OR sourcetype="stream:http")
| regex _raw="(?i)<!DOCTYPE[^>]*\["
| regex _raw="(?i)<!ENTITY[^>]*SYSTEM\s+[\"'](file|http|https)://"
| stats count min(_time) as first_seen max(_time) as last_seen by host, source, user
| where count > 0

Wazuh OSSEC Rule

<group name="jetbrains,xxe,">
  <rule id="100750" level="8" frequency="1">
    <regex>(?i)<!DOCTYPE\s+[^>]*\[</regex>
    <regex>(?i)<!ENTITY\s+\w+\s+SYSTEM\s+["'](file|http|https)://</regex>
    <description>CVE-2026-75058: Possible XXE payload in IntelliJ IDEA Eclipse settings importer input</description>
    <group>cve-2026-75058,</group>
  </rule>
</group>

This rule relies on logcollector or FIM feeding file content to the analysis engine; subject to tuning to avoid false positives on legitimate DTD-bearing files.

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source; no vendor advisory has been confirmed. The NVD description implies that IntelliJ IDEA 2026.2.1 addresses the issue, but this has not been independently verified by the tracked patch sources used for this report.

1. Immediate mitigations (until a verified patch is deployed):

• Do not import Eclipse settings, workspace bundles, or project archives from untrusted or unsolicited sources. Enforce a policy that all Eclipse-to-IntelliJ imports originate from approved internal templates only.
• Scan inbound archives and settings files for DTD/entity declarations before they reach developer workstations; block files matching the YARA/Sigma patterns above.
• Run the IDE with least-privilege credentials so that any XXE-inducing file read is limited to files the developer account needs, rather than administrator-accessible files.
• If the IDE's JVM startup configuration supports standard Java XML processing hardening (e.g., properties that restrict external DTD access such as javax.xml.accessExternalDTD), enable them to the most restrictive values supported by the platform.
• Apply egress filtering at the endpoint and network level to block unexpected outbound HTTP(S) connections from IDE processes to non-allowlisted destinations.

2. Patch/upgrade steps:

• Upgrade IntelliJ IDEA to version 2026.2.1 or later as soon as the vendor release is verified. Validate the release against JetBrains' official update channel rather than third-party mirrors.
• Track the NVD entry and JetBrains security bulletins for an official advisory; re-run the patch-confidence assessment once a vendor confirmation is published.

3. Long-term hardening:

• Treat developer workstations as high-value assets: enforce full-disk encryption, credential separation, and secrets management so that a single file-read disclosure does not yield standing privileges.
• Maintain content-aware endpoint detection (EDR/FIM) capable of inspecting XML files for entity declarations, and tune the detection rules above to local baseline behavior.
• Establish a secure supply-chain import policy: all third-party IDE configurations, project templates, and settings bundles must be reviewed and re-packaged by the security team before distribution.
• Monitor CISA KEV and EPSS for future updates; if CVE-2026-75058 is added to KEV or an exploit is published, escalate priority and expedite the upgrade across all developer endpoints.

References

• NVD Entry — CVE-2026-75058: https://nvd.nist.gov/vuln/detail/CVE-2026-75058
• CWE-611 (Improper Restriction of XML External Entity Reference): https://cwe.mitre.org/data/definitions/611.html
• OWASP XML External Entity (XXE) Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
• JetBrains IntelliJ IDEA official site / download archive (for verifying 2026.2.1 availability): https://www.jetbrains.com/idea/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-75058 currently NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat-actor activity note: As of this report, no public exploit code exists, no Nuclei template is available, no in-the-wild exploitation has been reported, and no threat-actor campaigns have been attributed to CVE-2026-75058. All exploitation scenarios above are inferred from the CWE-611 vulnerability class and the CVSS attack-vector metadata.