CVE-2026-111095 JetBrains CVE debrief

Who should care

Defenders responsible for JetBrains TeamCity deployments should assess exposure and apply patches or mitigations to prevent potential attacks.

Why it matters

CVE-2026-111095 is a high-severity vulnerability in JetBrains TeamCity, allowing for stored cross-site scripting (XSS) in the classic project overview. Defenders should prioritize verifying exposure and applying patches or mitigations to prevent potential attacks.

• Verify exposure and apply patches or mitigations to prevent potential attacks
• Implement compensating controls to reduce the attack surface
• Monitor for suspicious activity and exception tracking to detect potential exploitation

Technical summary

The vulnerability allows for stored cross-site scripting (XSS) in the classic project overview of JetBrains TeamCity. This could enable attackers to inject malicious scripts, potentially leading to unauthorized actions or data breaches. The vulnerability affects versions prior to 2026.2, 2026.1.4, and 2025.11.8. Defenders should prioritize verifying exposure and applying patches or mitigations to prevent potential attacks.

Defensive priority

Defenders should prioritize verifying exposure and applying patches or mitigations, as this vulnerability could allow attackers to inject malicious scripts.

Recommended defensive actions

• Verify exposure by checking TeamCity versions and applying patches or mitigations as needed
• Implement compensating controls, such as input validation and output encoding
• Monitor for suspicious activity and exception tracking

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, CVSS score, and affected versions. The vulnerability allows for stored cross-site scripting (XSS) in the classic project overview of JetBrains TeamCity. Defenders should verify exposure and apply patches or mitigations to prevent potential attacks. The source item provides CVE details, and the CVE Program record has source-provided CVE metadata. The official NIST NVD detail page and source-

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.