CVE-2025-42921
Jetbrains Toolbox ≤ 2.6
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:NSummary
CVE-2025-42921 is a medium-severity Improper Validation of Certificate with Host Mismatch (CWE-297) vulnerability in Jetbrains Toolbox. Its CVSS base score is 4.2 (Medium).
Operationally, ranked at the 9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-23 (Session Authenticity) and SC-8 (Transmission Confidentiality and Integrity) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-11576
Vulnerability Data
In JetBrains Toolbox App before 2.6 host key verification was missing in SSH plugin
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Host key verification directly enforces session authenticity for SSH connections, preventing MITM by ensuring the remote endpoint identity matches the expected key.
Missing host verification allows integrity compromise of the SSH channel; SC-8 requires cryptographic protection of transmission integrity for remote sessions.
Requires unique identification and authentication of devices (the SSH server) prior to establishing the connection, which host key checking implements.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Protecting data-in-transit integrity depends on proper certificate validation to prevent MITM.
Secure development practices include coding correct certificate validation logic.
Server/service authentication via certificates directly requires correct host validation.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect missing certificate validation and host-mismatch checks.
Network security controls include certificate validation and host-name verification to prevent man-in-the-middle attacks.
Security of network services requires proper TLS configuration and certificate validation for service endpoints.
Use of cryptography mandates correct implementation of certificate validation and hostname verification.
Application security requirements include secure communication and certificate validation for external services.
Secure system architecture principles require proper certificate validation to protect communications.