Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
CVE-2026-111094 Overview
CVE-2026-111094 is a remote code execution vulnerability in JetBrains TeamCity, a widely deployed continuous integration and continuous delivery (CI/CD) server. The flaw stems from a whitelist bypass in the build messages protocol, allowing attackers to execute arbitrary code on the TeamCity server. The vulnerability is network-exploitable without authentication or user interaction, placing exposed TeamCity instances at direct risk. JetBrains addressed the issue in TeamCity 2026.2, 2026.1.4, and 2025.11.8. Because TeamCity holds source code, build artifacts, deployment credentials, and signing keys, successful exploitation can cascade into broader software supply-chain compromise.
Critical Impact
Unauthenticated attackers can achieve remote code execution on vulnerable JetBrains TeamCity servers by bypassing the build messages protocol whitelist, exposing CI/CD pipelines and source code to compromise.
Affected Products
- JetBrains TeamCity versions prior to 2026.2
- JetBrains TeamCity versions prior to 2026.1.4 on the 2026.1 branch
- JetBrains TeamCity versions prior to 2025.11.8 on the 2025.11 branch
Discovery Timeline
- 2026-10-15 - CVE-2026-111094 published to NVD
- 2026-10-16 - Last updated in NVD database
Technical Details for CVE-2026-111094
Vulnerability Analysis
The vulnerability resides in TeamCity's build messages protocol, which agents use to report build status, test results, and service messages back to the server. The protocol enforces a whitelist to restrict which message types and payloads the server will process. CVE-2026-111094 reflects a bypass of that whitelist, enabling an attacker to deliver unsanitized input that the server deserializes or interprets as executable logic. The vulnerability is classified under [CWE-502: Deserialization of Untrusted Data], indicating that attacker-controlled serialized objects can reach a trust-sensitive execution path.
Successful exploitation gives the attacker code execution in the context of the TeamCity server process. From that foothold, an adversary can read source repositories, inject malicious build steps, exfiltrate deployment secrets, and pivot into downstream production environments. The EPSS probability currently sits at 0.383%, but the low attack complexity and network exposure justify immediate remediation.
Root Cause
The root cause is insufficient validation in the build messages protocol handler. The whitelist intended to constrain acceptable message structures can be bypassed through crafted inputs that satisfy surface-level checks while smuggling unsafe payloads to downstream deserialization or command-processing routines. The combination of a permissive protocol surface and unsafe object handling creates the RCE primitive.
Attack Vector
An attacker reaches the vulnerable code path over the network by sending crafted build messages to the TeamCity server. Because the CVSS vector indicates no authentication requirement, any actor able to speak the build messages protocol to an exposed TeamCity instance can attempt exploitation. Internet-facing TeamCity deployments and build networks with weak segmentation are the highest-risk configurations.
No public proof-of-concept code is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the JetBrains Security Issues Fixed advisory for vendor technical details.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-111094
Indicators of Compromise
- Unexpected child processes spawned by the TeamCity server process (for example, java spawning sh, bash, cmd.exe, or powershell.exe).
- Anomalous outbound network connections from the TeamCity server to unknown hosts, especially shortly after inbound build-agent traffic.
- New or modified build configurations, build steps, or administrative users that were not created through normal change-management channels.
- Access to or exfiltration of config/projects directories, VCS credentials, or deployment secrets stored in TeamCity.
Detection Strategies
- Monitor TeamCity server logs for malformed or unexpected build messages and protocol parsing errors preceding unusual process activity.
- Alert on process-lineage anomalies where the TeamCity Java process launches interpreters or system utilities uncommon in normal CI operations.
- Inspect agent-to-server traffic for build message payloads containing serialized object markers or encoded command sequences.
Monitoring Recommendations
- Enable verbose auditing on TeamCity administrative actions, authentication events, and build configuration changes.
- Forward TeamCity application and system logs to a centralized analytics platform for correlation with endpoint telemetry.
- Baseline normal outbound connectivity from the TeamCity host and alert on deviations such as connections to code-hosting or paste services.
How to Mitigate CVE-2026-111094
Immediate Actions Required
- Upgrade TeamCity to 2026.2, 2026.1.4, or 2025.11.8 or later, matching your current release branch.
- Remove direct internet exposure of the TeamCity web interface and agent ports; place the server behind a VPN or reverse proxy with strict access control.
- Rotate credentials, API tokens, VCS access keys, and signing material accessible to the TeamCity server if compromise is suspected.
- Review recent build configurations, administrative actions, and audit logs for unauthorized changes.
Patch Information
JetBrains has released fixed versions 2026.2, 2026.1.4, and 2025.11.8 that address the whitelist bypass in the build messages protocol. Refer to the JetBrains Security Issues Fixed page for the authoritative advisory and upgrade guidance. Apply the patch on a maintenance window and validate agent connectivity after the upgrade.
Workarounds
- Restrict network access to the TeamCity server so only trusted build agents and administrative users can reach it.
- Place the TeamCity server in a segmented network zone with egress filtering to prevent attacker command-and-control from a compromised host.
- Enforce least privilege on the operating system account running TeamCity to limit the blast radius of any code execution.
# Example firewall policy restricting TeamCity ports to known agent subnets
# Replace the subnet and interface values to match your environment
iptables -A INPUT -p tcp --dport 8111 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8111 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
