CVE-2026-111094: 
JetBrains TeamCity vulnerability analysis and mitigation

CVE-2026-111094 is a remote code execution vulnerability in JetBrains TeamCity caused by a whitelist bypass in the build messages protocol. It affects TeamCity versions before 2026.2, 2026.1.4, and 2025.11.8. The vulnerability was published on October 15, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) per NVD, and 8.1 (High) per the GitHub Advisory Database and EUVD, reflecting differing assessments of attack complexity (GitHub Advisory, JetBrains).

The root cause is classified as CWE-502 (Deserialization of Untrusted Data), mapped to CAPEC-586 (Object Injection). An attacker can exploit a whitelist bypass in TeamCity's build messages protocol to deliver malicious serialized data to the server, which is then deserialized without adequate validation. The attack is network-based and requires no authentication or user interaction, though the GitHub Advisory rates attack complexity as High, suggesting some precondition or environmental factor may be involved. No public proof-of-concept or detailed technical write-up has been disclosed as of the publication date (GitHub Advisory, JetBrains).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code on the TeamCity server, resulting in full compromise of confidentiality, integrity, and availability. An attacker gaining code execution on a CI/CD server such as TeamCity could access source code, build artifacts, secrets, and credentials stored in pipelines, and potentially pivot to connected development or production infrastructure. The NVD assessment characterizes the technical impact as "total" (GitHub Advisory, JetBrains).

As of the disclosure date, there is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation (GitHub Advisory). The NVD SSVC assessment confirms exploitation status as "none" and notes the attack is not fully automatable. The EPSS score is approximately 0.38%, placing it in the 31st percentile for likelihood of exploitation within 30 days. No threat actor attribution or CISA KEV catalog listing has been reported (GitHub Advisory).

JetBrains has released patched versions addressing this vulnerability: TeamCity 2025.11.8, 2026.1.4, and 2026.2 or later. Organizations should upgrade to one of these versions as the primary remediation. If immediate patching is not feasible, restrict network access to TeamCity servers and monitor for anomalous build message protocol activity or unexpected process execution originating from the TeamCity service (JetBrains, GitHub Advisory).