JetBrains TeamCity CVE-2026-111095

Exploitation requires an authenticated TeamCity account (PR:L) with sufficient rights to store attacker-controlled content that renders in the 'classic project overview' page - this specific legacy/classic UI view is the affected feature. The payload is dormant until a second user, typically a higher-privileged administrator, opens that classic project overview (UI:R), at which point the stored script executes in their session. Limiting factors: attacker must already be an authenticated low-privilege user, a privileged victim must actively navigate to the classic overview, and only TeamCity versions before 2026.2 / 2026.1.4 / 2025.11.8 are affected; instances already upgraded or not exposing the classic project overview to lower-privileged contributors are not realistically exploitable.

This is a genuine but conditional risk rather than a drop-everything emergency. The CVSS 3.1 base score of 8.0 is driven largely by the scope change (S:C) and the maximal C:H/I:H/A:H impact metrics typical of vendor scoring for XSS that can hijack a privileged session. However, the exploitation prerequisites temper this: AV:N confirms network reachability, but PR:L means the attacker must already hold an authenticated TeamCity account with rights to inject content into a project, AC:H indicates non-trivial conditions, and UI:R requires a victim to view the affected classic project overview page. No EPSS probability was provided and the CVE is NOT in CISA KEV, so there is no public exploit identified at time of analysis - exploitation is theoretical as of this analysis. The combination of required authentication, high attack complexity, and mandatory victim interaction means real-world risk is moderate: most dangerous in multi-tenant/shared CI environments where a low-privileged developer could target an administrator. Note: the vendor-assigned C:H/I:H/A:H likely reflects downstream session-hijack potential rather than a direct impact on TeamCity's own data confidentiality, so the headline 8.0 somewhat overstates the first-order impact of a stored XSS - treat it as a privilege-escalation-via-admin-session vector, prioritized for internet-exposed or shared TeamCity instances but below unauthenticated RCE class bugs.

A low-privileged but authenticated TeamCity user injects a malicious script into a field that renders on the classic project overview page. When a project administrator later views that overview, the stored script executes in their authenticated browser session, allowing the attacker to hijack the admin session, steal CI tokens, or alter build configurations. No public exploit code is identified, and successful exploitation depends on an administrator actually visiting the poisoned classic view.