---
title: JetBrains TeamCity CVE-2026-111094: unauthenticated RCE through a build-messages whitelist bypass (CVSS 8.1) | ctxsec
url: https://ctxsec.com/items/teamcity-cve-2026-111094
description: ""
status: "confirmed (vendor CVE record), not exploited, not on KEV"
published: 2026-10-15
---

> 

[← Cybersecurity News](/news) · [markdown](/items/teamcity-cve-2026-111094.md)

confirmed (vendor CVE record), not exploited, not on KEV

2026-10-15

### JetBrains TeamCity CVE-2026-111094: unauthenticated RCE through a build-messages whitelist bypass (CVSS 8.1)

JetBrains (as CNA, Oct 15) published CVE-2026-111094: in TeamCity before 2026.2, 2026.1.4 and 2025.11.8, "remote code execution via a whitelist bypass in the build messages protocol was possible" (CWE-502 deserialization). JetBrains scores it CVSS 3.1 8.1 (network, high complexity, no privileges, no user interaction). CISA's enrichment lists exploitation as none. Some X posts cite 9.8; the vendor's record says 8.1. TeamCity has been exploited before (CVE-2023-42793 and CVE-2024-27198 are on KEV), so upgrade self-hosted servers, especially internet-facing ones.

Sources: [CVE-2026-111094](https://www.cve.org/CVERecord?id=CVE-2026-111094) · [JetBrains fixed security issues](https://www.jetbrains.com/privacy-security/issues-fixed/)