JetBrains (as CNA, Oct 15) published CVE-2026-111094: in TeamCity before 2026.2, 2026.1.4 and 2025.11.8, "remote code execution via a whitelist bypass in the build messages protocol was possible" (CWE-502 deserialization). JetBrains scores it CVSS 3.1 8.1 (network, high complexity, no privileges, no user interaction). CISA's enrichment lists exploitation as none. Some X posts cite 9.8; the vendor's record says 8.1. TeamCity has been exploited before (CVE-2023-42793 and CVE-2024-27198 are on KEV), so upgrade self-hosted servers, especially internet-facing ones.