EUVD-2026-89999
GHSA-4858-hf6j-x5pg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network abuse of the reset flow (PR:N, AV:N) but gated by a non-trivial precondition (AC:H); admin takeover yields full C/I/A:H with no scope change.
Primary rating from Vendor (JetBrains).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset
AnalysisAI
JetBrains TeamCity versions prior to 2026.2, 2026.1.4, and 2025.11.8 contain a flaw in the password reset mechanism that permits an unauthenticated remote attacker to take over an administrator account. The vulnerability requires a non-trivial condition (AC:H) related to improper validation of input equivalence (CWE-1289), so exploitation is not fully turnkey. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation targets the password-reset functionality of JetBrains TeamCity to achieve administrator account takeover, exploitable remotely by unauthenticated attackers (PR:N, UI:N) over the network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely high-priority flaw despite thin external signals. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: 2026.2, 2026.1.4, and 2025.11.8. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every TeamCity instance in the estate, confirm its exact version, and restrict network access to the TeamCity web interface to trusted management networks or VPN only, prioritizing any server reachable from the internet; simultaneously force credential rotation and multi-factor enrollment for all administrator accounts and enable audit logging on authentication and password reset events. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Path traversal in JetBrains TeamCity before 2023.11.4 enables remote attackers to perform a limited set of administrativ
Remote code execution in JetBrains TeamCity before 2026.1.3 and 2025.11.7 allows unauthenticated attackers to execute ar
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible. Rated criti
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible. Rated criti
In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible. Rated critical severity (CVSS
Remote code execution in JetBrains TeamCity before 2026.1.2 and 2025.11.6 allows an attacker to escape the Kotlin DSL sa
Sandbox escape in JetBrains TeamCity's Kotlin DSL configuration mechanism allows an attacker who can supply or modify ve
In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expiration. Rated critical s
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 authentication bypass was possible in specific e
In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible. Rated c
JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection in the Agent Push feature configuration. Rated
In JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was possible. Rated critical sev
Share
External POC / Exploit Code
Leaving vuln.today