CVE-2026-111094
Undergoing Analysis Undergoing Analysis - In Progress

Remote Code Execution in JetBrains TeamCity via Whitelist Bypass

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: JetBrains s.r.o.

Description
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-111094
EUVD
EUVD-2026-102147

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
JetBrains TeamCity 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows remote code execution in JetBrains TeamCity before versions 2026.2, 2026.1.4, and 2025.11.8 due to a whitelist bypass in the build messages protocol.

Impact Analysis

An attacker could exploit this to execute arbitrary code on the affected TeamCity server, potentially leading to full system compromise, data theft, or disruption of services.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR (data protection) and HIPAA (health information privacy) requirements, potentially resulting in legal penalties and reputational damage.

Mitigation Strategies

Update JetBrains TeamCity to version 2026.2, 2026.1.4, or 2025.11.8 or later to address the remote code execution vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111094. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart