External risk intelligence

JetBrains TeamCity Git VCS Root Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-65907

JetBrains TeamCity is commonly deployed as a centralized build server and management service. While access is typically restricted to authorized users, these platforms are frequently exposed to internal networks or the public internet to facilitate developer access and remote integration, making the management surface a common point of network-reachable deployment.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability has been identified in JetBrains TeamCity, a widely used software development platform. This issue allows for unauthorized code execution, potentially impacting the integrity and availability of systems utilizing this technology. Understanding the nature of this vulnerability and confirming its relevance to our environment is the primary concern.

Unauthorized code can be run on TeamCity.
It affects a common development and management tool.
Confirm if TeamCity is in use and assess exposure.

Attack Path

How an attacker could exploit the issue

A privileged attacker could exploit this vulnerability by manipulating Git repositories associated with TeamCity's version control system integration. Successful exploitation could lead to arbitrary code execution on the TeamCity server, potentially allowing the attacker to compromise the build environment and access sensitive information.

Requires authenticated access.
Manipulating Git repositories triggers vulnerability.
Leads to remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an authenticated attacker to execute arbitrary code on the server when interacting with Git repositories. This could impact the integrity and availability of the TeamCity server and potentially lead to the exposure of sensitive system information when exploited under supported conditions.

Server code execution.
Exploitation via Git VCS roots.
Compromise of server integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world ownership of this vulnerability likely falls to teams managing the JetBrains TeamCity deployment, such as platform or infrastructure teams, in coordination with security operations for exposure assessment. The initial practical step is to identify all TeamCity instances, confirm their network reachability and criticality, and then assign an accountable owner to plan remediation based on the identified risk.

Platform or infrastructure teams own remediation.
Verify TeamCity instance reachability and criticality.
Plan coordinated updates or vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is JetBrains TeamCity?

TeamCity is a continuous integration and continuous deployment (CI/CD) server. Development teams use it to automate the building, testing, and deployment of software projects. It acts as a central hub for managing source code changes, making it a critical component in the software development lifecycle.

What does CWE-94 mean for CVE-2026-65907?

CWE-94 refers to improper control of generation of code. In the context of this vulnerability, it means the TeamCity server can be tricked into executing unauthorized commands. An attacker can leverage this weakness to run their own code on the server, which can compromise the entire build environment.

How is this vulnerability triggered?

An attacker must have authenticated access and interact with the Git Version Control System (VCS) roots managed by TeamCity. This is not triggered by casual browsing or simple network requests; it requires a specific level of system interaction where repository settings or data are manipulated to force the server to execute malicious instructions.

Is my instance relevant to this CVE?

According to Halo Surface Signal, TeamCity is frequently deployed in ways that make it network-reachable, either on internal networks or the public internet to support distributed teams. If your instance is reachable via the network to those with authorized access, you should evaluate your risk, as the server's role as a central management tool increases its potential impact if compromised.

What steps should I take if I use TeamCity?

First, identify all active TeamCity instances within your infrastructure and confirm their current versions. Since this vulnerability affects versions before 2026.1.2, you should coordinate with your platform or infrastructure teams to plan an update. Check official JetBrains security bulletins to verify the required version and apply the necessary patches to protect your build environment.

References

www.jetbrains.com/privacy-security/issues-fixed/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.