CVE-2026-75060 — JetBrains PyCharm Unauthenticated Jupyter MCP Code Execution

Executive Summary

CVE-2026-75060 is a high-severity (CVSS 8.4) vulnerability in JetBrains PyCharm versions prior to 2026.2.1 that allows arbitrary code execution through Jupyter MCP (Model Context Protocol) tools exposed without authentication (CWE-306). Any unauthenticated actor with local access to a developer workstation running an affected PyCharm version can invoke these tools to execute code in the context of the PyCharm/Jupyter process. Because developer workstations typically hold source code, credentials, and access to CI/CD pipelines, successful exploitation results in full host compromise with significant supply-chain blast radius. No patch confidence has been established by tracked sources, and no public exploit code has been observed.

Technical Analysis

The NVD description for CVE-2026-75060 states: "In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP tools." The description is sparse, and no further technical detail — such as specific tool names, protocol endpoints, or parameter structure — is available in the public advisory data provided. Analysis is therefore performed at the vulnerability-class level.

The core flaw maps to CWE-306: Missing Authentication for Critical Function. PyCharm integrates with Jupyter notebook kernels through MCP (Model Context Protocol) tool interfaces. MCP is a client–server protocol used to expose tools and data to AI/LLM assistants; in this scenario, the Jupyter MCP tools act as a bridge between PyCharm and a Jupyter kernel execution engine. The vulnerability indicates that this tool layer does not enforce authentication prior to performing critical functions — namely, submitting code to a Jupyter kernel for execution.

The CVSS v3.1 vector — CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — provides the following constraints:

• AV:L (Local): The attacker must have local, host-level access to the affected system. Remote network-only exploitation is not reflected by this vector.
• AC:L (Low): No race condition, randomization evasion, or complex state is required.
• PR:N (None): No privileges are required. A low-privileged local process, another local user account, or unauthenticated local service interaction is sufficient.
• UI:N (None): No victim interaction is required — the intended user need not open a file, visit a URL, or click anything.
• C:H/I:H/A:H (High/High/High): Full confidentiality, integrity, and availability impact.

The attack surface is the local Jupyter/MCP tool interface exposed by an affected PyCharm installation. Because the MCP tool channel is unauthenticated, any local actor capable of reaching the interface (e.g., via inter-process communication or a locally bound network service) can invoke kernel-execution functionality. The execution occurs with the privileges of the PyCharm/Jupyter process, which typically runs as the logged-in developer user. Insufficient technical detail is available to enumerate exact function names, URI paths, or MCP tool identifiers; detection must therefore rely on behavioral indicators of the vulnerability class rather than fixed signatures.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability description and CVSS characteristics.

1. Reconnaissance / target identification. The attacker requires local access to the victim's workstation (AV:L). This may be achieved through malware already running as a low-privileged user, a shared/thin-client environment, a compromised local service, or physical access. The attacker identifies a running PyCharm instance and probes for the Jupyter MCP tool interface — typically by enumerating locally listening ports or examining running process/service metadata for Jupyter or MCP components.

2. Triggering the flaw. The attacker sends unauthenticated requests to the Jupyter MCP tool channel. Because the critical functions performed by these tools lack an authentication check (CWE-306), the request is accepted without any credential, token, or session validation. This corresponds to the PR:N and UI:N components of the CVSS vector — no privilege escalation step is required prior to triggering.

3. Payload / execution method. The attacker leverages the MCP tool's code-submission capability to deliver an arbitrary code payload to the underlying Jupyter kernel. The kernel executes the payload in the context of the PyCharm process, resulting in native code execution on the host. The payload can be any standard command executed by the kernel (e.g., a shell command, Python script, or binary download-and-execute chain). Specific tool names and payload syntax are not documented in the public description, so finer-grained payload construction cannot be specified.

4. Post-exploitation impact. With code execution as the developer user, the attacker can exfiltrate source code and credentials, install persistence mechanisms (scheduled tasks, autostart entries, kernel-level hooks), and pivot to internal resources accessible from the developer's session — including source-control repositories, cloud consoles, package registries, and CI/CD runners. The C:H/I:H/A:H subscores reflect this complete loss of confidentiality, integrity, and availability on the affected host and any downstream systems.

Impact Assessment

CVSS v3.1 base score: 8.4 (High). The vector indicates high impact across all three security objectives with no privilege requirement and no user interaction, tempered only by the local attack vector.

• Business impact: Developer workstations are high-value targets. Successful exploitation yields access to proprietary source code, environment secrets, signing keys, and developer credentials. An attacker with this foothold can inject malicious code into software builds, poison dependencies, or forge commits — turning a single endpoint compromise into a software supply-chain incident affecting downstream customers and partners.
• Affected systems: All JetBrains PyCharm editions and distributions prior to 2026.2.1 with Jupyter integration and MCP tools enabled. The exact default-enabled state of the vulnerable feature is not disclosed in the available data; organizations should assume it is reachable in default configurations until a vendor advisory is published.
• Blast radius: The S:U (Scope: Unchanged) component indicates the compromise is confined to the vulnerable component's authority — that of the PyCharm/Jupyter process, i.e., the developer's OS user context. However, the lateral movement and supply-chain potential from a developer-user compromise far exceeds the immediate process boundary.

Patch confidence is 0/4 — no tracked source confirms an available fix, despite the description indicating 2026.2.1 as the resolving version. Until a verified vendor advisory and patch artifact are available, organizations cannot assume mitigations are embedded in the product update channel.

Detection Guidance

The following detection content is heuristic and class-based, since no confirmed indicators of compromise, exploit samples, or C2 infrastructure have been published for this CVE. Rules focus on anomalous process behavior from PyCharm, local Jupyter/MCP service access, and suspicious child process execution.

Sigma Rule

title: Suspicious Child Process Spawned from JetBrains PyCharm (Jupyter MCP Abuse)
id: 9c6a3b2e-7506-4a60-9a6e-7d5b0a0c1c2d
status: experimental
description: Detects shell or scripting interpreters spawned by PyCharm processes,
  potentially indicating unauthenticated code execution via Jupyter MCP tools (CVE-2026-75060).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-75060
author: Valtersit Threat Intelligence
date: 2026/07/20
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\pycharm64.exe'
      - '\pycharm.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\python.exe'
      - '\sh.exe'
      - '\bash.exe'
  selection_flags:
    CommandLine|contains:
      - 'base64'
      - 'Invoke-Expression'
      - '-enc'
      - 'wget'
      - 'curl'
      - 'python -c'
  condition: selection_parent and selection_child and selection_flags
level: high
falsepositives:
  - Developer running legitimate build or test scripts from within the IDE
  - Jupyter kernel launching python.exe for normal notebook execution (rare as a direct child of pycharm)

YARA Rule

rule CVE_2026_75060_PyCharm_Jupyter_MCP_Abuse
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects script content referencing Jupyter/MCP tooling combined with code execution primitives"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-75060"
        date = "2026-07-20"
        cve = "2026-75060"
    strings:
        $a = "jupyter" ascii wide nocase
        $b = "mcp" ascii wide nocase
        $c = "pycharm" ascii wide nocase
        $d = "exec(" ascii wide nocase
        $e = "eval(" ascii wide nocase
        $f = "subprocess" ascii wide nocase
        $g = "os.system" ascii wide nocase
    condition:
        uint16(0) == 0x5A4D and   // PE file
        (($a or $b or $c) and ($d or $e or $f or $g))
}

Suricata IDS Rule

alert http any any -> $HOME_NET 8888 ( \
  msg:"CVE-2026-75060 Potential Unauthenticated Jupyter MCP Code Execution Attempt"; \
  flow:to_server,established; \
  http.method; content:"POST"; \
  http.uri; pcre:"/(jupyter|mcp)/Ui"; \
  content:"Content-Type"; http.header_names; \
  reference:cve,2026-75060; \
  reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-75060; \
  classtype:attempted-user; \
  sid:7506001; rev:1;)

Note: Port 8888 is the conventional default Jupyter HTTP port; tune $HOME_NET and the destination port to match observed local deployments. Because the vulnerability is locally scoped (AV:L), network detection is only effective where MCP/Jupyter services are bound to non-loopback interfaces or reachable across a segmented host network.

Elastic Detection

sequence by host.id with maxspan=30s
  [ network where event.type == "start" and
      destination.port == 8888 and
      network.direction == "inbound" ] 
  [ process where event.type == "start" and
      process.parent.name in ("pycharm64.exe", "pycharm", "pycharm.sh") and
      process.name in ("cmd.exe", "powershell.exe", "pwsh.exe", "python.exe", "sh", "bash") ]

Additionally, a standalone process rule for immediate child-process anomalies:

process where event.type == "start" and
  process.parent.name in ("pycharm64.exe", "pycharm") and
  process.name in ("cmd.exe", "powershell.exe", "pwsh.exe", "python.exe", "sh", "bash") and
  (process.command_line contains "base64" or
   process.command_line contains "Invoke-Expression" or
   process.command_line contains "-enc" or
   process.command_line contains "python -c")

Splunk SPL Query

index=endpoint sourcetype=WinEventLog:Security OR sourcetype="XmlWinEventLog" 
| where ParentImage LIKE "%pycharm%" 
  AND (Image LIKE "%cmd.exe" OR Image LIKE "%powershell.exe" OR Image LIKE "%python.exe" OR Image LIKE "%bash%")
| search CommandLine="*base64*" OR CommandLine="*Invoke-Expression*" OR CommandLine="*-enc*" OR CommandLine="*python -c*"
| table _time, host, User, ParentImage, Image, CommandLine
| stats count by host, ParentImage, Image

Wazuh OSSEC Rule

<group name="pycharm,jupyter,mcp,">
  <!-- Requires Sysmon process creation events (EventID 1) ingested via Wazuh -->
  <rule id="948041" level="12">
    <decoded>
      <program_name>sysmon</program_name>
    </decoded>
    <field name="win.eventdata.eventID">1</field>
    <field name="win.eventdata.parentImage" type="pcre2">(?i)pycharm</field>
    <field name="win.eventdata.image" type="pcre2">(?i)(cmd\.exe|powershell\.exe|pwsh\.exe|python\.exe|sh|bash)</field>
    <description>CVE-2026-75060: Suspicious child process spawned from JetBrains PyCharm (potential unauthenticated Jupyter MCP code execution)</description>
    <mitre><id>T1203</id></mitre>
    <group>pycharm_jupyter_mcp,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No tracked source has confirmed an available fix or vendor advisory, even though the NVD description indicates PyCharm 2026.2.1 resolves the issue. Treat any mitigation as interim until a verified vendor patch is released.

1. Immediate mitigations:

   • Disable the Jupyter MCP tool integration in PyCharm (IDE plugin/tool settings) on all developer workstations where notebook/MCP functionality is not strictly required.
   • Restrict interactive and remote access to developer machines; enforce strong authentication and session monitoring for RDP/SSH/VPN access.
   • Apply host-based firewalls to block unsolicited inbound connections to local Jupyter/MCP ports (customary default: 8888) from non-loopback sources.
   • Run EDR/AV with behavioral detection enabled and forward the collection rules above to your SIEM/SOAR.

2. Patch / upgrade steps:

   • Monitor JetBrains' official security advisories and the PyCharm release notes for confirmation of the 2026.2.1 fix and any interim hotfixes.
   • Once a verified patch artifact is available, upgrade all affected PyCharm installations to 2026.2.1 or later. Validate the CVE-2026-75060 remediation in a staging environment before broad rollout.
   • Until then, do not assume the upgrade channel alone resolves the issue — verify the fix against a reproduction or vendor confirmation.

3. Long-term hardening:

   • Enforce least privilege on developer endpoints; segment code-execution services (Jupyter/MCP) from the interactive user session where feasible.
   • Adopt application allowlisting to restrict which interpreters (python.exe, cmd.exe, powershell.exe) can be spawned by IDE processes.
   • Extend supply-chain security monitoring: treat developer workstation compromise as a precursor to CI/CD and repository integrity incidents, and audit commit signing and build-agent trust.
   • Maintain a baseline inventory of IDE integrations and disable all MCP/LLM tooling not explicitly approved by the security team.

References

1. NVD Entry — CVE-2026-75060: https://nvd.nist.gov/vuln/detail/CVE-2026-75060
2. JetBrains Security Advisories portal (monitor for official PyCharm advisory): https://www.jetbrains.com/security/
3. CWE-306 — Missing Authentication for Critical Function: https://cwe.mitre.org/data/definitions/306.html
4. MITRE ATT&CK — T1203 Exploitation for Client Execution: https://attack.mitre.org/techniques/T1203/
5. CISA Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-75060 is not currently listed; no exploit-in-the-wild evidence or known threat-actor campaigns have been confirmed at the time of writing: https://www.cisa.gov/known-exploited-vulnerabilities-catalog