Summary
generated automatically from NVD dataJetBrains TeamCity contains a flaw in its build messages protocol, where a whitelist bypass allows remote code execution. The weakness is classified as CWE-502 (deserialization of untrusted data). The NVD description lists TeamCity versions before 2026.2, 2026.1.4 and 2025.11.8 as affected. It carries a CVSS v3.1 score of 8.1 (HIGH), with a network attack vector, high attack complexity, and no privileges or user interaction required.
NVD description
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible
EPSS · FIRST.org
0.38%probability of exploitation in the next 30 days
Higher than 30% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-19, recomputed daily by FIRST.org.
CVSS v3.1 Score
Information
- Published
- 15 oct. 2026
- Updated
- 16 oct. 2026
- Status
- Analyzed
- Source
- cve@jetbrains.com
Affected products
Weaknesses (CWE)
References (1)
- https://www.jetbrains.com/privacy-security/issues-fixed/Vendor Advisory
Similar CVEs
Other vulnerabilities of type CWE-502
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.