CVE-2026-111094: TeamCity On-Premises RCE via whitelist bypass in the build messages protocol

Critical 9.8 EPSS 0.4%

JetBrains TeamCity On-Premises allowed remote code execution through a bypass of the whitelist in the build messages protocol (TW-103081). JetBrains scores it CVSS 8.1 with no privileges required (AV:N/AC:H/PR:N), while NVD scores it 9.8 critical. It was fixed in 2026.2, 2026.1.4 and 2025.11.8 together with other high-severity issues, including a Kotlin DSL sandbox escape and an administrator account takeover via password reset.

CVE-2026-111094CVE identifier
9.8CVSS 3.1 base score (critical)
0.4%EPSS: chance of exploitation in the next 30 days (higher than 33% of CVEs)
2026-10-15published

What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms

What to do now

Check whether you run the affected software and which version (commands below).
Install the fixed version for your system: see “Patch it” below.
The TeamCity server is stopped and started as part of the upgrade; follow JetBrains' upgrade guide for build agents.
If you cannot patch today, apply the temporary mitigation below and patch as soon as possible.

Affected and fixed versions

Affected:

TeamCity On-Premises before 2025.11.8 (2025.11.x and all older versions)
TeamCity On-Premises 2026.1.x before 2026.1.4

Fixed in:

TeamCity 2026.2
TeamCity 2026.1.4
TeamCity 2025.11.8

Am I affected?

curl -s -u <admin-user> https://teamcity.example.com/app/rest/server | grep -o 'version="[^"]*"'
docker ps --format '{{.Image}}' | grep teamcity-server

Patch it

Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.

Docker images

# back up first; TeamCity Docker containers can only be updated manually
docker pull jetbrains/teamcity-server:2026.2.1   # or 2026.1.5 / 2025.11.8
docker stop teamcity-server-instance && docker rm teamcity-server-instance
docker run -d --name teamcity-server-instance -v <path-to-data-directory>:/data/teamcity_server/datadir -v <path-to-logs-directory>:/opt/teamcity/logs -p <port-on-host>:8111 jetbrains/teamcity-server:2026.2.1

Built from source

# .tar.gz install in /opt/TeamCity; back up first (data directory, database, customized conf/server.xml)
# alternatively use Administration | Updates (automatic update) in the web UI
cd /opt
wget https://download.jetbrains.com/teamcity/TeamCity-2026.2.1.tar.gz   # or TeamCity-2026.1.5.tar.gz / TeamCity-2025.11.8.tar.gz
sudo -u teamcity /opt/TeamCity/bin/teamcity-server.sh stop
sudo mv /opt/TeamCity /opt/TeamCity.old
sudo tar xfz TeamCity-2026.2.1.tar.gz
sudo chown -R teamcity:teamcity /opt/TeamCity
# re-apply any customized conf/server.xml settings, then:
sudo -u teamcity /opt/TeamCity/bin/teamcity-server.sh start

General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.

If you cannot patch yet

Do not expose TeamCity On-Premises directly to the internet; restrict access to the server (and the agent port) to trusted networks or a VPN until upgraded.

Related vulnerabilities

Sources

Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.