# Jetbrains TeamCity vulnerabilities Source: https://junglewise.ai/threats/technologies/teamcity Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/teamcity.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 34 vulnerabilities in Jetbrains TeamCity: 0 in the last 7 days and 8 in the last 90 days, 5 of them critical and 4 exploited in the wild. The most recent, CVE-2026-111096, was published on 15 October 2026. 3 vulnerabilities in the last four weeks, down 40% on the four before (5). ## Counts - Last 7 days: 0 - Last 30 days: 3 - Last 90 days: 8 - All time: 34 (5 critical, 4 exploited in the wild) ## About Jetbrains TeamCity A continuous integration and continuous delivery server for automating software build, test, and deployment processes. ## Latest Jetbrains TeamCity vulnerabilities - [CVE-2026-111096: JetBrains TeamCity stored XSS in classic build log](https://junglewise.ai/threats/cve-2026-111096-in-jetbrains-teamcity-before-2026-2-2026-1-4-2025-11-8-stored) (medium, CVSS 6.7, published 15 Oct 2026) - [CVE-2026-111095: JetBrains TeamCity stored XSS in project overview](https://junglewise.ai/threats/cve-2026-111095-in-jetbrains-teamcity-before-2026-2-2026-1-4-2025-11-8-stored) (high, CVSS 8, published 15 Oct 2026) - [CVE-2026-111094: JetBrains TeamCity remote code execution in build messages protocol](https://junglewise.ai/threats/cve-2026-111094-in-jetbrains-teamcity-before-2026-2-2026-1-4-2025-11-8-remote) (high, CVSS 8.1, published 15 Oct 2026) - [CVE-2026-106219: JetBrains TeamCity Git submodule URL validation bypass](https://junglewise.ai/threats/cve-2026-106219-in-jetbrains-teamcity-before-2026-2-1-missing-validation-of-git) (medium, CVSS 6.5, published 6 Oct 2026) - [CVE-2026-106218: JetBrains TeamCity Kotlin DSL sandbox escape RCE](https://junglewise.ai/threats/cve-2026-106218-in-jetbrains-teamcity-before-2026-1-3-2025-11-7-kotlin-dsl) (high, CVSS 8.8, published 6 Oct 2026) - [CVE-2026-100255: JetBrains TeamCity administrator account takeover via password reset](https://junglewise.ai/threats/cve-2026-100255-in-jetbrains-teamcity-before-2026-2-2026-1-4-2025-11-8) (high, CVSS 8.1, published 30 Sep 2026) - [CVE-2026-100254: JetBrains TeamCity command execution via CRLF injection in Git](https://junglewise.ai/threats/cve-2026-100254-in-jetbrains-teamcity-before-2026-2-2026-1-4-2025-11-8) (high, CVSS 8.8, published 30 Sep 2026) - [CVE-2026-100253: JetBrains TeamCity sandbox escape in versioned settings Kotlin DSL](https://junglewise.ai/threats/cve-2026-100253-in-jetbrains-teamcity-before-2026-2-2026-1-4-2025-11-8-sandbox) (high, CVSS 8.8, published 30 Sep 2026) - [CVE-2026-63077: JetBrains TeamCity remote code execution in agent polling protocol](https://junglewise.ai/threats/cve-2026-63077-jetbrains-teamcity-remote-code-execution-in-agent-polling) (critical, exploited in the wild, CVSS 9.8, published 27 Jul 2026) - [CVE-2026-65907: JetBrains TeamCity code execution in Git VCS roots](https://junglewise.ai/threats/cve-2026-65907-jetbrains-teamcity-code-execution-in-git-vcs-roots) (critical, CVSS 9.1, published 23 Jul 2026) - [CVE-2026-65906: JetBrains TeamCity remote code execution via Kotlin DSL sandbox escape](https://junglewise.ai/threats/cve-2026-65906-jetbrains-teamcity-remote-code-execution-via-kotlin-dsl-sandbox) (high, CVSS 8.8, published 23 Jul 2026) - [CVE-2026-59796: JetBrains TeamCity improper permission checks in pipeline modification](https://junglewise.ai/threats/cve-2026-59796-jetbrains-teamcity-improper-permission-checks-in-pipeline) (high, CVSS 8.1, published 10 Jul 2026) - [CVE-2026-59795: JetBrains TeamCity stored XSS in agent registration](https://junglewise.ai/threats/cve-2026-59795-jetbrains-teamcity-stored-xss-in-agent-registration) (high, CVSS 8.1, published 10 Jul 2026) - [CVE-2026-59794: JetBrains TeamCity stored XSS in cloud profile page](https://junglewise.ai/threats/cve-2026-59794-jetbrains-teamcity-stored-xss-in-cloud-profile-page) (high, CVSS 7.3, published 10 Jul 2026) - [CVE-2026-59793: JetBrains TeamCity arbitrary file access in Perforce VCS integration](https://junglewise.ai/threats/cve-2026-59793-jetbrains-teamcity-arbitrary-file-access-in-perforce-vcs) (high, CVSS 8.8, published 10 Jul 2026) - [CVE-2026-49381: JetBrains TeamCity stored XSS on SAML login page](https://junglewise.ai/threats/cve-2026-49381-jetbrains-teamcity-stored-xss-on-saml-login-page) (low, CVSS 3.4, published 29 May 2026) - [CVE-2026-49380: JetBrains TeamCity open redirect in SAML plugin](https://junglewise.ai/threats/cve-2026-49380-jetbrains-teamcity-open-redirect-in-saml-plugin) (low, CVSS 3.1, published 29 May 2026) - [CVE-2026-49379: JetBrains TeamCity credential exposure in thread names](https://junglewise.ai/threats/cve-2026-49379-jetbrains-teamcity-credential-exposure-in-thread-names) (medium, CVSS 6.5, published 29 May 2026) - [CVE-2026-49378: JetBrains TeamCity credential exposure via parameter autocompletion](https://junglewise.ai/threats/cve-2026-49378-jetbrains-teamcity-credential-exposure-via-parameter) (medium, CVSS 4.3, published 29 May 2026) - [CVE-2026-49377: JetBrains TeamCity sensitive data exposure in default agent parameters](https://junglewise.ai/threats/cve-2026-49377-jetbrains-teamcity-sensitive-data-exposure-in-default-agent) (medium, CVSS 4.3, published 29 May 2026) - [CVE-2026-49376: JetBrains TeamCity insufficient username validation in SAML plugin](https://junglewise.ai/threats/cve-2026-49376-jetbrains-teamcity-insufficient-username-validation-in-saml) (medium, CVSS 6.5, published 29 May 2026) - [CVE-2026-49375: JetBrains TeamCity reflected XSS in repository download page](https://junglewise.ai/threats/cve-2026-49375-jetbrains-teamcity-reflected-xss-in-repository-download-page) (medium, CVSS 6.1, published 29 May 2026) - [CVE-2026-49374: JetBrains TeamCity improper permission checks in build configuration](https://junglewise.ai/threats/cve-2026-49374-jetbrains-teamcity-improper-permission-checks-in-build) (high, CVSS 7.6, published 29 May 2026) - [CVE-2026-49373: JetBrains TeamCity remote code execution in Perforce connection settings](https://junglewise.ai/threats/cve-2026-49373-jetbrains-teamcity-remote-code-execution-in-perforce-connection) (high, CVSS 7.1, published 29 May 2026) - [CVE-2026-49372: JetBrains TeamCity unauthenticated SSRF in build status](https://junglewise.ai/threats/cve-2026-49372-jetbrains-teamcity-unauthenticated-ssrf-in-build-status) (high, CVSS 7.5, published 29 May 2026) ## Most severe Jetbrains TeamCity vulnerabilities - [CVE-2026-63077: JetBrains TeamCity remote code execution in agent polling protocol](https://junglewise.ai/threats/cve-2026-63077-jetbrains-teamcity-remote-code-execution-in-agent-polling) (critical, exploited in the wild, CVSS 9.8, published 27 Jul 2026) - [CVE-2024-27198: JetBrains TeamCity Authentication Bypass Vulnerability](https://junglewise.ai/threats/cve-2024-27198-jetbrains-teamcity-authentication-bypass-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 7 Mar 2024) - [CVE-2023-42793: JetBrains TeamCity Authentication Bypass Vulnerability](https://junglewise.ai/threats/cve-2023-42793-jetbrains-teamcity-authentication-bypass-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 4 Oct 2023) - [CVE-2024-27199: JetBrains TeamCity relative path traversal in admin interface](https://junglewise.ai/threats/cve-2024-27199-jetbrains-teamcity-relative-path-traversal-in-admin-interface) (critical, exploited in the wild, CVSS 7.3, published 20 Apr 2026) - [CVE-2026-65907: JetBrains TeamCity code execution in Git VCS roots](https://junglewise.ai/threats/cve-2026-65907-jetbrains-teamcity-code-execution-in-git-vcs-roots) (critical, CVSS 9.1, published 23 Jul 2026) - [CVE-2026-106218: JetBrains TeamCity Kotlin DSL sandbox escape RCE](https://junglewise.ai/threats/cve-2026-106218-in-jetbrains-teamcity-before-2026-1-3-2025-11-7-kotlin-dsl) (high, CVSS 8.8, published 6 Oct 2026) - [CVE-2026-100254: JetBrains TeamCity command execution via CRLF injection in Git](https://junglewise.ai/threats/cve-2026-100254-in-jetbrains-teamcity-before-2026-2-2026-1-4-2025-11-8) (high, CVSS 8.8, published 30 Sep 2026) - [CVE-2026-100253: JetBrains TeamCity sandbox escape in versioned settings Kotlin DSL](https://junglewise.ai/threats/cve-2026-100253-in-jetbrains-teamcity-before-2026-2-2026-1-4-2025-11-8-sandbox) (high, CVSS 8.8, published 30 Sep 2026) - [CVE-2026-65906: JetBrains TeamCity remote code execution via Kotlin DSL sandbox escape](https://junglewise.ai/threats/cve-2026-65906-jetbrains-teamcity-remote-code-execution-via-kotlin-dsl-sandbox) (high, CVSS 8.8, published 23 Jul 2026) - [CVE-2026-59793: JetBrains TeamCity arbitrary file access in Perforce VCS integration](https://junglewise.ai/threats/cve-2026-59793-jetbrains-teamcity-arbitrary-file-access-in-perforce-vcs) (high, CVSS 8.8, published 10 Jul 2026) ## Vulnerabilities per week 3 vulnerabilities in the last four weeks, down 40% on the four before (5). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 3 | 0 | 0 | | 5 Oct 2026 | 2 | 0 | 0 | | 12 Oct 2026 | 3 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Jetbrains technologies - [Jetbrains YouTrack](https://junglewise.ai/threats/technologies/youtrack): 83 vulnerabilities - [Jetbrains IntelliJ IDEA](https://junglewise.ai/threats/technologies/intellij-idea): 51 vulnerabilities - [Jetbrains Datalore](https://junglewise.ai/threats/technologies/datalore): 16 vulnerabilities - [Jetbrains Hub](https://junglewise.ai/threats/technologies/hub): 11 vulnerabilities - [Jetbrains Webstorm](https://junglewise.ai/threats/technologies/webstorm): 8 vulnerabilities - [Jetbrains GoLand](https://junglewise.ai/threats/technologies/goland): 7 vulnerabilities - [Jetbrains PyCharm](https://junglewise.ai/threats/technologies/pycharm): 7 vulnerabilities - [Jetbrains CLion](https://junglewise.ai/threats/technologies/clion): 6 vulnerabilities - [Jetbrains PhpStorm](https://junglewise.ai/threats/technologies/phpstorm): 6 vulnerabilities - [Jetbrains Rider](https://junglewise.ai/threats/technologies/rider): 4 vulnerabilities - [Jetbrains Toolbox App](https://junglewise.ai/threats/technologies/toolbox-app): 4 vulnerabilities - [Jetbrains Junie CLI](https://junglewise.ai/threats/technologies/junie-cli): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Jetbrains TeamCity vulnerabilities", https://junglewise.ai/threats/technologies/teamcity, 9 November 2026.