TeamCity vulnerabilities

5 known vulnerabilities in TeamCity from JetBrains. 5 are rated high or critical, and 4 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  TeamCity: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-100254Sep 30, 2026JetBrains

  In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings

• 9.8 Critical severity

  JetBrains TeamCity Deserialization of Untrusted Data Exploited

  CVE-2026-63077Jul 27, 2026JetBrainsEPSS 94.9%

  In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol

• 7.3 High severity

  JetBrains TeamCity Relative Path Traversal Exploited

  CVE-2024-27199Mar 4, 2024JetBrainsEPSS 100%

  In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible

• 9.8 Critical severity

  JetBrains TeamCity Authentication Bypass Exploited

  CVE-2024-27198Mar 4, 2024JetBrainsEPSS 99.9%

  In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible

• 9.8 Critical severity

  JetBrains TeamCity Authentication Bypass Exploited

  CVE-2023-42793Sep 19, 2023JetBrainsEPSS 100%

  In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible