Jetbrains: >> Teamcity Security Vulnerabilities
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 stored XSS in the classic project overview was possible
CVSS Score
8.0
EPSS Score
0.002
Published
2026-10-15
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 stored XSS in the classic build log was possible
CVSS Score
6.7
EPSS Score
0.002
Published
2026-10-15
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible
CVSS Score
8.1
EPSS Score
0.004
Published
2026-10-15
In JetBrains TeamCity before 2026.1.3
2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible
CVSS Score
8.8
EPSS Score
0.003
Published
2026-10-06
In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server
CVSS Score
6.5
EPSS Score
0.007
Published
2026-10-06
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 administrator account takeover was possible via password reset
CVSS Score
8.1
EPSS Score
0.004
Published
2026-09-30
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL
CVSS Score
8.8
EPSS Score
0.004
Published
2026-09-30
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings
CVSS Score
8.8
EPSS Score
0.005
Published
2026-09-30
CVE-2026-63077
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
Known exploited
CVSS Score
9.8
EPSS Score
0.936
Published
2026-07-27
In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible
CVSS Score
8.8
EPSS Score
0.007
Published
2026-07-23
Page 1