CVE-2026-64815 is an arbitrary code injection vulnerability in JetBrains IntelliJ IDEA before version 2026.2. The issue arises from improper handling of UI Designer form files, which allows an attacker to inject and execute arbitrary code. The vulnerability is classified under CWE-94, indicating improper control over code generation. The CVSS 3.1 score of 8.1 reflects high impact with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed by JetBrains as of the publication date.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary code on the affected system remotely, potentially leading to full system compromise. The impact includes complete loss of confidentiality, integrity, and availability of the affected system running IntelliJ IDEA versions prior to 2026.2. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor JetBrains advisories closely for updates. Until a patch is available, avoid opening untrusted UI Designer form files and consider restricting access to such files to trusted sources only.