External risk intelligence

JetBrains TeamCity Build Messages Protocol Whitelist Bypass Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-111094

JetBrains TeamCity is a continuous integration and continuous deployment (CI/CD) server. These platforms are commonly deployed as network-accessible services to facilitate build and deployment pipelines across distributed teams, making them frequently reachable in enterprise network environments.

Deserialization

Jetbrains Teamcity

before 2025.11.82026.1 to before 2026.1.4

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in JetBrains TeamCity, a widely used platform for continuous integration and deployment. This issue could allow for unauthorized remote code execution, potentially impacting the integrity and availability of systems that rely on this technology. The main concern is confirming its relevance and exposure within our environment.

Bypass allows remote code execution.
CI/CD platforms are high-value targets.
Confirm relevance and exposure to TeamCity.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted messages to a TeamCity server over the network. This bypasses security checks within the build messages protocol, potentially allowing the attacker to execute arbitrary code on the server.

Network access required.
Triggered by build messages protocol.
Leads to remote code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an unauthenticated attacker could achieve remote code execution on JetBrains TeamCity servers by bypassing a whitelist in the build messages protocol. This could impact the integrity and availability of the server and any data it processes.

Server code execution is at risk.
Whitelist bypass could allow unauthorized commands.
Compromise of build processes and data.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in JetBrains TeamCity's build messages protocol impacts application owners and platform teams responsible for CI/CD infrastructure. The immediate first step is to inventory all TeamCity instances, assess their network exposure and business criticality, and identify the accountable team for each. This information is crucial for prioritizing and planning the appropriate remediation or mitigation strategy.

Identify the CI/CD platform owner.
Verify TeamCity's network reachability and criticality.
Plan coordinated remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is JetBrains TeamCity?

TeamCity is a continuous integration and continuous deployment (CI/CD) server used by development teams to automate, manage, and execute software build pipelines. It acts as a central hub where code is tested, built, and prepared for release, making it a critical component for coordinating software delivery across distributed environments.

How does the CVE-2026-111094 vulnerability work?

This vulnerability is classified as CWE-502, which involves deserialization of untrusted data. In this specific case, an attacker can bypass a whitelist intended to restrict commands within the build messages protocol. By sending specially crafted messages, the attacker tricks the server into executing arbitrary code, effectively allowing them to run unauthorized instructions on the underlying system.

What triggers this remote code execution flaw?

The vulnerability is triggered when an attacker sends malicious input to the TeamCity server over the network via the build messages protocol. It requires network connectivity to the affected service to transmit the crafted messages. Merely logging in or performing standard administrative actions does not trigger the flaw; it relies specifically on manipulating the build message communication path.

Why is this CVE significant for my network environment?

Halo Surface Signal indicates that TeamCity is often deployed as a network-accessible service to support global build pipelines, increasing the likelihood of exposure. Because this is a critical vulnerability that can be exploited remotely without authentication, any instance reachable over the network should be considered a high-priority target for unauthorized access.

What should I do if I manage TeamCity servers?

Your first step is to perform an inventory of all TeamCity instances to identify which ones are running the affected versions. Once you have a complete list, verify their network accessibility and business criticality. Coordinate with the platform owners to prioritize these systems for updates or necessary security modifications to mitigate the risks associated with this protocol bypass.

References

www.jetbrains.com/privacy-security/issues-fixed/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.