CVE-2026-86484 is a stored XSS vulnerability in JetBrains YouTrack prior to version 2026.2.18634. The issue arises from AngularJS template injection in assignee names, enabling an attacker to inject malicious scripts that are stored and executed in the context of other users. The vulnerability requires network access, low attack complexity, and limited privileges with user interaction. The CVSS vector indicates partial confidentiality and integrity impact without availability impact.

An attacker with limited privileges can inject malicious scripts into assignee names, which are then stored and executed in the context of other users viewing those names. This can lead to partial confidentiality and integrity compromise, such as theft of sensitive information or manipulation of data within the affected application. There is no impact on system availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented in the provided data. Users should monitor JetBrains advisories for updates and apply patches once available.