CVE-2026-111094

9.8Critical

Published 15 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash

9.8Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-502

Impact

Remote attackers can execute arbitrary code on the TeamCity server without authentication over the network. Exploitation requires sending malicious build messages that bypass protocol filtering.

Root cause

An unsafe deserialization flaw allows attackers to bypass a whitelist in the build messages protocol.

Affected systems

JetBrains TeamCity versions before 2026.2, 2026.1.4, and 2025.11.8.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade JetBrains TeamCity to version 2025.11.8, 2026.1.4, 2026.2, or later. If upgrading immediately is not possible, restrict network access to the TeamCity server build communication ports to trusted agent networks only.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible

References

https://www.jetbrains.com/privacy-security/issues-fixed/Vendor Advisory

Source: nvd.nist.gov/vuln/detail/CVE-2026-111094