CVE-2026-59795
Received Received - Intake

Stored XSS in JetBrains TeamCity via Unauthenticated Agent Registration

Publication date: 2026-07-10

Last updated on: 2026-07-10

Assigner: JetBrains s.r.o.

Description
In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possible

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-10
Last Modified
2026-07-10
Generated
2026-07-10
AI Q&A
2026-07-10
EPSS Evaluated
N/A
NVD
CVE-2026-59795
EUVD
EUVD-2026-42913

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jetbrains teamcity to 2026.1.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stored Cross-Site Scripting (XSS) issue in JetBrains TeamCity versions before 2026.1.2. It occurs via unauthenticated agent registration, meaning an attacker can inject malicious scripts without needing to log in or authenticate.

Impact Analysis

The vulnerability can lead to serious impacts including the execution of malicious scripts in the context of the affected application. This can result in the compromise of confidentiality and integrity of data, as indicated by the high CVSS score with high impact on confidentiality and integrity. However, availability is not affected.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59795. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart