Patch Forecast
Amber warning
Patch this week.

CVE-2026-111094

Jetbrains Teamcity: unsafe deserialisation can lead to remote code execution

Risk score
70/100
CVSS
9.8 v3.1
Exploit chance (30 days)
0.4%
Published
15 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible
Affected
Jetbrains Teamcity before 2026.2, 2026.1.4, 2025.11.8
Fix
Upgrade Jetbrains Teamcity to 2026.2, 2026.1.4 or 2025.11.8 (whichever matches your release line), or later.
Exploitation
No known exploitation

Story map

Story map: Jetbrains TeamcityTHE FLAWSTHE FIXCVE-2026-111094Unsafe deserialisation can leadto remote code executionCVSS 9.8 · EPSS 0%CVE-2026-63077JetBrains TeamCityDeserialization of UntrustedData VulnerabilityCVSS 9.8 · exploitedCVE-2026-100255In JetBrains TeamCity before2026.2, 2026.1.4, 2025.11.8administrator account…CVSS 9.8 · EPSS 0%CVE-2026-106218In JetBrains TeamCity before2026.1.3 2025.11.7 kotlin DSLsandbox escape leading to RCE…CVSS 10.0 · EPSS 0%Upgrade Jetbrains Teamcity2026.2 · 2026.1.4 · 2025.11.8 ·2026.1.3 · 2025.11.7or later on your release lineWho is exposedJetbrains Teamcity before2026.1.3, 2025.11.7RED · ACT TODAYJetbrainsTeamcityIn JetBrains TeamCity before2026.1.3, 2025.11.7unauthenticated remote codeexecution was possible via theagent polling protocolWhere it standsExploited in the wildOn CISA's exploited list since 5 AugUS federal deadline 8 AugHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.5 Aug · CISAAdded to the Known Exploited Vulnerabilities list8 Aug · DeadlineUS federal agencies must have patchedCONNECTS TOSame weaknessUnsafe deserialisation (CWE-502)249 other warnings in 30 days →Same productEarlier Jetbrains Teamcity warnings5 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Jetbrains Teamcity: Red, act today. In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol

The flaws

  • CVE-2026-111094: Unsafe deserialisation can lead to remote code execution (CVSS 9.8 · EPSS 0%)
  • CVE-2026-63077: JetBrains TeamCity Deserialization of Untrusted Data Vulnerability (CVSS 9.8 · exploited)
  • CVE-2026-100255: In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was… (CVSS 9.8 · EPSS 0%)
  • CVE-2026-106218: In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the… (CVSS 10.0 · EPSS 0%)

The fix

Upgrade Jetbrains Teamcity: 2026.2 · 2026.1.4 · 2025.11.8 · 2026.1.3 · 2025.11.7 or later on your release line

Who is exposed: Jetbrains Teamcity before 2026.1.3, 2025.11.7

Where it stands

  • Exploited in the wild
  • On CISA's exploited list since 5 Aug
  • US federal deadline 8 Aug

How it unfolded

  1. 5 Aug, CISA (official): Added to the Known Exploited Vulnerabilities list
  2. 8 Aug, Deadline (official): US federal agencies must have patched

Connects to

Why it is Amber

  • CVSS 9.8 critical
  • Remotely exploitable without logging in

References

Original description

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible

Last activity 15 Oct 2026. Patch Forecast updates every hour.