nTLM Hash Disclosure in JetBrains Toolbox App
CVE-2026-123856

6.5MEDIUM

Key Information:

Vendor

Jetbrains
Status
Toolbox App
Vendor
CVE Published:
6 November 2026

What is CVE-2026-123856?

The JetBrains Toolbox App is susceptible to an nTLM hash disclosure vulnerability due to improper handling of SVG tool icons within remote development environments. This flaw allows attackers to gain unauthorized access to sensitive hash information, potentially compromising user security. It is crucial to update to version 3.6.1 or later to mitigate risks associated with this vulnerability.

Affected Version(s)

Toolbox App Windows 0 < 3.6.1

References

https://www.jetbrains.com/privacy-security/issues-fixed/

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.