PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-111094 JetBrains CVE debrief

CVE-2026-111094 debrief based on CVE Program and NIST NVD records. The vulnerability affects JetBrains TeamCity instances, allowing remote code execution via a whitelist bypass in the build messages protocol. This issue impacts JetBrains TeamCity administrators and security teams, who should assess exposure and verify patch status. The CVE record indicates that versions before 2026.2, 2026.1.4, and 2025.11.8 are vulnerable. Defenders should monitor for suspicious activity and verify patch status.

Vendor
JetBrains
Product
TeamCity
CVSS
HIGH 8.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-15
Original CVE updated
2026-10-16
Advisory published
2026-10-15
Advisory updated
2026-10-16

Who should care

JetBrains TeamCity administrators and security teams should assess exposure and verify patch status. They should also monitor build messages protocol for suspicious activity and review compensating controls for exposed systems while remediation is scheduled and verified. Additionally, they should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Why it matters

CVE-2026-111094 allows remote code execution in JetBrains TeamCity instances; defenders should assess exposure, verify patch status, and monitor for suspicious activity

  • Remote code execution possible via whitelist bypass
  • Requires verification of patch status and upgrade to fixed versions
  • Monitoring build messages protocol for suspicious activity recommended

Technical summary

CVE-2026-111094: JetBrains TeamCity vulnerable to remote code execution via whitelist bypass in build messages protocol before versions 2026.2, 2026.1.4, and 2025.11.8. The vulnerability allows remote code execution, impacting JetBrains TeamCity administrators and security teams. They should assess exposure, verify patch status, and monitor for suspicious activity. The CVE record and NVD details provide source-grounded technical framing.

Defensive priority

Assess exposure and verify patch status for JetBrains TeamCity instances

Recommended defensive actions

  • Inventory and assess exposure of JetBrains TeamCity instances
  • Verify patch status and upgrade to fixed versions (2026.2, 2026.1.4, or 2025.11.8)
  • Monitor build messages protocol for suspicious activity

Evidence notes

Limited evidence available; CVE description and NVD records indicate remote code execution via whitelist bypass in build messages protocol. The CVE Program and NIST NVD records provide details on the vulnerability. However, additional verification is required to confirm affected scope and severity. Defenders should review official advisories and CVE records to validate affected scope, severity, and vendor guidance.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-111094 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-111094

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-111094 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-111094

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.