Key points
- JetBrains TeamCity versions before 2026.2, 2026.1.4, and 2025.11.8 are affected by CVE-2026-111094.
- The flaw permits remote code execution through a whitelist bypass in the build messages protocol.
- The National Vulnerability Database rates the issue as high severity with a CVSS score of 8.1.
JetBrains TeamCity contains a remote code execution vulnerability that affects versions released before 2026.2, 2026.1.4, and 2025.11.8. Security researchers have assigned the identifier CVE-2026-111094 to this issue, which carries a high severity rating of 8.1 on the Common Vulnerability Scoring System scale.
What happened
The National Vulnerability Database record for CVE-2026-111094 describes a weakness in JetBrains TeamCity that allows for remote code execution. This capability exists in all versions of the software prior to 2026.2, 2026.1.4, and 2025.11.8. The underlying issue is classified under CWE-502, which relates to deserialization of untrusted data.
The vulnerability stems from a whitelist bypass within the build messages protocol. According to the NVD description, this flaw enables an attacker to execute arbitrary code remotely. The specific mechanism involves circumventing the intended restrictions of the protocol used for build messaging. This allows unauthorised commands to be processed by the server.
Why it matters
Remote code execution flaws in continuous integration and delivery platforms pose significant risks to software supply chains. The NVD record states that remote code execution via a whitelist bypass in the build messages protocol was possible. The high CVSS score of 8.1 indicates a high severity rating for the vulnerability.
Organisations using older versions of TeamCity are particularly exposed. The affected versions include 2025.11.8 and earlier releases, as well as the 2026.1 branch before version 2026.1.4. The whitelist bypass in the build messages protocol removes a critical layer of defence. This could allow attackers to compromise the entire build server and potentially access connected systems.
What happens next
- Identify all instances of JetBrains TeamCity running versions before 2026.2, 2026.1.4, or 2025.11.8.
- Plan an immediate upgrade to the latest supported version to address CVE-2026-111094.
- Monitor build logs for unusual activity that may indicate exploitation of the whitelist bypass.
- Review network segmentation to limit the impact if a build server is compromised.
Patch priority
Teams usually prioritise systems that face the internet or accept input from untrusted networks. Check whether your TeamCity instances are exposed to external users or third-party integrations. Isolate these environments from critical production assets where possible. Test the upgrade process in a non-production environment first to ensure stability. Back up configuration data before applying any changes.
If immediate patching is not feasible, restrict network access to the build server to known IP addresses only. Monitor logs for signs of unauthorised command execution via the build messages protocol. Reduce the attack surface by disabling unnecessary plugins or features that interact with the build process. Ensure that only authorised personnel can trigger builds or modify project settings. Regularly audit user permissions to prevent privilege escalation attempts.
Background: Remote code execution vulnerabilities
Remote code execution often occurs because developers trust user input without validation, fail to restrict file permissions, or neglect to update dependencies. Fix these errors by enforcing strict input sanitisation, applying least-privilege principles, and integrating automated security checks into your secure software development lifecycle to prevent arbitrary command execution.
Read the full guide: Seven Configuration Mistakes That Allow Remote Code Execution
What to do and how to stay safe: JetBrains
- Audit your inventory of JetBrains TeamCity servers to identify any running versions prior to 2026.2, 2026.1.4, or 2025.11.8.
- Schedule an upgrade to the latest available version as soon as possible to mitigate the risk of remote code execution.
- Restrict network access to TeamCity instances to limit exposure to potential attackers exploiting the whitelist bypass.
- Monitor system logs for unexpected commands or processes initiated through the build messages protocol.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of JetBrains TeamCity are affected by CVE-2026-111094?
Versions before 2026.2, 2026.1.4, and 2025.11.8 are affected by this remote code execution vulnerability.
What is the severity rating of CVE-2026-111094?
The National Vulnerability Database rates the vulnerability as high severity with a CVSS score of 8.1.
How is the vulnerability exploited?
The flaw is exploited via a whitelist bypass in the build messages protocol, allowing remote code execution.
