CVE-2026-100255: 
JetBrains TeamCity vulnerability analysis and mitigation

CVE-2026-100255 is an administrator account takeover vulnerability in JetBrains TeamCity that allows unauthenticated attackers to hijack administrator accounts via a flawed password reset mechanism. It affects TeamCity versions before 2026.2, before 2026.1.4 (in the 2026.1.x branch), and before 2025.11.8 (in the 2025.11.x branch). The vulnerability was published on September 30, 2026, and patches were made available on October 2, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) (JetBrains Advisory).

The root cause is classified as CWE-1289 (Improper Validation of Unsafe Equivalence in Input), meaning the password reset flow fails to properly validate or distinguish between legitimate and attacker-controlled inputs, enabling an unauthenticated actor to manipulate the reset process to gain control of an administrator account. The attack vector is network-based, requires no privileges, no user interaction, and has low attack complexity, making it trivially exploitable against exposed TeamCity instances. No public proof-of-concept code has been identified at this time (JetBrains Advisory).

Successful exploitation grants an unauthenticated remote attacker full administrative control over the affected TeamCity instance, resulting in high confidentiality, integrity, and availability impact. An attacker with administrator access to TeamCity can manipulate CI/CD pipelines, inject malicious build steps, exfiltrate source code and secrets (e.g., API keys, credentials stored in build configurations), and potentially pivot to connected infrastructure such as deployment targets and artifact repositories. The technical impact is assessed as total system compromise (JetBrains Advisory).

As of the time of disclosure, there is no evidence of active in-the-wild exploitation and no public proof-of-concept exploit has been observed (JetBrains Advisory). The EPSS score is approximately 0.43%, reflecting a currently low but non-negligible probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection coverage exists via Qualys (IDs 532807, 388874) and Nessus (ID 364474).

1. Reconnaissance: Identify internet-facing JetBrains TeamCity instances running vulnerable versions (before 2025.11.8 or 2026.1.4/2026.2) using tools such as Shodan or Censys, searching for TeamCity login pages.
2. Initiate password reset: Navigate to the TeamCity password reset endpoint and submit a reset request targeting a known or guessed administrator account (e.g., the default admin username).
3. Exploit improper input validation: Manipulate the password reset request parameters — leveraging the CWE-1289 flaw — to bypass proper equivalence checks in the reset token or identity validation logic, allowing the attacker to set a new password for the administrator account without possessing a valid reset token.
4. Authenticate as administrator: Log in to TeamCity using the newly set administrator credentials.
5. Achieve objectives: With full admin access, modify build pipelines to inject malicious code, exfiltrate stored secrets and credentials, or establish persistence within the CI/CD environment for further lateral movement (JetBrains Advisory).

• Network: Unexpected or repeated HTTP requests to TeamCity password reset endpoints from external or unknown IP addresses; unusual login activity from new IP addresses following a password reset event.
• Logs: TeamCity server logs showing password reset requests for administrator accounts not initiated by the account owner; successful administrator logins from IP addresses not previously associated with that account; audit log entries reflecting administrator account password changes without a corresponding user-initiated request.
• Process/Behavior: Unexpected modifications to build configurations, addition of new build steps, or creation of new administrator accounts shortly after a password reset event; unusual outbound connections from build agents to external hosts.

JetBrains has released patched versions: 2025.11.8, 2026.1.4, and 2026.2 or later. Organizations should upgrade to one of these versions immediately. As an interim workaround where patching is not immediately possible, restrict network access to TeamCity instances (e.g., place behind a VPN or firewall), and monitor or temporarily disable the password reset functionality if the platform allows. Prioritize patching for any internet-exposed TeamCity deployments given the critical severity and unauthenticated attack vector (JetBrains Advisory).