Patch Forecast
Amber warning
Patch this week.

CVE-2026-106219

In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading…

Risk score
60/100
CVSS
7.5 v3.1
Exploit chance (30 days)
0.6%
Published
6 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server
Affected
Jetbrains Teamcity before 2026.2.1
Fix
Upgrade Jetbrains Teamcity to 2026.2.1 or later.
Exploitation
No known exploitation

Story map

Story map: Jetbrains TeamcityTHE FLAWSTHE FIXCVE-2026-106219In JetBrains TeamCity before2026.2.1 missing validation ofGit submodule URLs allowed…CVSS 7.5 · EPSS 1%CVE-2026-63077JetBrains TeamCityDeserialization of UntrustedData VulnerabilityCVSS 9.8 · exploitedCVE-2026-111094Unsafe deserialisation can leadto remote code executionCVSS 9.8 · EPSS 0%CVE-2026-100255In JetBrains TeamCity before2026.2, 2026.1.4, 2025.11.8administrator account…CVSS 9.8 · EPSS 0%Upgrade Jetbrains Teamcity2026.2.1 · 2026.1.3 · 2025.11.7 ·2026.2 · 2026.1.4 · 2025.11.8or later on your release lineWho is exposedJetbrains Teamcity before2026.1.3, 2025.11.7RED · ACT TODAYJetbrainsTeamcityIn JetBrains TeamCity before2026.1.3, 2025.11.7unauthenticated remote codeexecution was possible via theagent polling protocolWhere it standsExploited in the wildOn CISA's exploited list since 5 AugUS federal deadline 8 AugHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.5 Aug · CISAAdded to the Known Exploited Vulnerabilities list8 Aug · DeadlineUS federal agencies must have patchedCONNECTS TOSame weaknessCWE-73 (CWE-73)55 other warnings in 30 days →Same productEarlier Jetbrains Teamcity warnings5 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Jetbrains Teamcity: Red, act today. In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol

The flaws

  • CVE-2026-106219: In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading… (CVSS 7.5 · EPSS 1%)
  • CVE-2026-63077: JetBrains TeamCity Deserialization of Untrusted Data Vulnerability (CVSS 9.8 · exploited)
  • CVE-2026-111094: Unsafe deserialisation can lead to remote code execution (CVSS 9.8 · EPSS 0%)
  • CVE-2026-100255: In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was… (CVSS 9.8 · EPSS 0%)

The fix

Upgrade Jetbrains Teamcity: 2026.2.1 · 2026.1.3 · 2025.11.7 · 2026.2 · 2026.1.4 · 2025.11.8 or later on your release line

Who is exposed: Jetbrains Teamcity before 2026.1.3, 2025.11.7

Where it stands

  • Exploited in the wild
  • On CISA's exploited list since 5 Aug
  • US federal deadline 8 Aug

How it unfolded

  1. 5 Aug, CISA (official): Added to the Known Exploited Vulnerabilities list
  2. 8 Aug, Deadline (official): US federal agencies must have patched

Connects to

Why it is Amber

  • CVSS 7.5 high
  • Remotely exploitable without logging in

References

Original description

In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server

Last activity 6 Oct 2026. Patch Forecast updates every hour.