CVE-2026-111095

8.0High

Published 15 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash

8.0High

Attack vector: Network
Complexity: High
Privileges needed: Low
User interaction: Required
Impact: Full C/I/A compromise
Weakness: CWE-79

Impact

Authenticated attackers can execute arbitrary JavaScript in a victim's browser session to hijack accounts or steal credentials when an administrator or user views the classic project overview page.

Root cause

Improper input sanitization allows persistent stored cross-site scripting (XSS) in the classic project overview interface.

Affected systems

JetBrains TeamCity versions prior to 2026.2, 2026.1.4, and 2025.11.8.

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Fix & remediation

Upgrade JetBrains TeamCity to version 2025.11.8, 2026.1.4, 2026.2, or later. If patching immediately is not possible, restrict access to the classic project overview interface and revoke untrusted user project edit permissions.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possible

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Source: nvd.nist.gov/vuln/detail/CVE-2026-111095