Vulnerabilities

TI-2026-64596 CVE-2026-100255 · GHSA-4858-hf6j-x5pg

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset

MEDIUM 43

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0035 Published 2026-09-30 Fixed in 2026.2, 2026.1.4 +1 CWE-1289

TI-2026-64595 CVE-2026-100254 · GHSA-6h2c-wm78-7wv3

OS command injection in JetBrains TeamCity

MEDIUM 40

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00472 Published 2026-09-30 Fixed in 2026.2, 2026.1.4 +1 CWE-78

TI-2026-64594 CVE-2026-100253 · GHSA-6hq9-538r-6p54

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code…

MEDIUM 40

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00444 Published 2026-09-30 Fixed in 2026.2, 2026.1.4 +1 CWE-184

Vulnerabilities

Filters

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset

OS command injection in JetBrains TeamCity

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code…