JetBrains TeamCity CVE-2026-111094 (CVSS 8.1): unauthenticated RCE via a whitelist bypass in the build messages protocol — patch 2026.2 / 2026.1.4 / 2025.11.8 (also two stored XSS)

JetBrains assigned CVE-2026-111094 on 15 October 2026 for TeamCity builds before 2026.2, 2026.1.4 and 2025.11.8: remote code execution was possible through a whitelist bypass in the build messages protocol (CVSS 3.1 8.1, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H — network, high attack complexity, no privileges or user interaction). The same advisory set includes CVE-2026-111095 (stored XSS in the classic project overview, CVSS 8.0) and CVE-2026-111096 (stored XSS in the classic build log, CVSS 6.7). JetBrains lists the fixes on its privacy-security issues-fixed page; there is no report of in-the-wild use in the CVE records. Distinct from the 6 October TeamCity Kotlin DSL sandbox RCE card (CVE-2026-106218) already on this desk. Primary: JetBrains issues-fixed / CVE records.

Product

JetBrains TeamCity

Versions

Affected: TeamCity before 2026.2, before 2026.1.4, and before 2025.11.8. Fixed: 2026.2, 2026.1.4, 2025.11.8.

CVSS

8.1 High (CVE-2026-111094, CVSS 3.1); 8.0 (CVE-2026-111095 XSS); 6.7 (CVE-2026-111096 XSS)

Exploited in Australia?

unknown

Patch to

Upgrade TeamCity to 2026.2, 2026.1.4 or 2025.11.8 (or a later build on your branch). Prioritise internet-facing and CI/CD controllers; review recent build-message traffic if the instance was exposed before patching.

Primary: JetBrains — Fixed security issues (TeamCity CVE-2026-111094 / 111095 / 111096) · Vendor: CVE-2026-111094 — JetBrains CNA (15 Oct 2026) · CVE: CVE-2026-111094, CVE-2026-111095, CVE-2026-111096, CVE-2026-106218 · Tenable — CVE-2026-111094

vulnerabilities cloud