JetBrains TeamCity CVE-2026-65907

Exploitation requires an authenticated account with sufficient privileges to create or modify a Git VCS root in TeamCity (per CVSS PR:H, high privileges - typically project-administrator-level rights), and specifically targets the Git VCS root configuration feature. There is no user-interaction requirement (UI:N) and the server is exploited over the network (AV:N). The key limiting factors are: the attacker must already possess VCS-configuration permissions on a project, the target must run TeamCity before 2026.1.2 or 2025.11.6, and the affected code path is the Git VCS root handling - users without VCS edit rights cannot trigger it.

The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) describes a network-reachable, low-complexity, no-interaction flaw with full confidentiality/integrity/availability impact but requiring high privileges (PR:H), which is the primary limiting factor and prevents opportunistic mass exploitation. No EPSS score, KEV entry, POC, or SSVC decision data was supplied, so exploitation-probability signals are absent rather than low - treat the 9.1 as reflecting impact and reachability, not confirmed real-world exploitation. The realistic risk is that of privilege escalation and lateral movement: a user who already holds VCS-configuration rights (typically project administrators) can convert that limited authority into arbitrary code execution across the CI/CD environment. This is a genuine priority for organizations running TeamCity as shared multi-tenant build infrastructure, but the PR:H requirement means it is not an unauthenticated internet-wide threat; the missing EPSS/KEV data should be re-checked against JetBrains and CISA before final triage.

A user holding project-administrator or VCS-root editing rights on a shared TeamCity server creates or edits a Git VCS root, injecting a malicious payload into a Git parameter that the server processes as code. When the VCS operation runs, the injected code executes in the context of the server or its build agents, giving the attacker command execution on the CI/CD infrastructure and a foothold to reach build secrets, artifacts, or downstream systems. No public exploit is currently identified, and the low attack complexity (AC:L) means that once a valid privileged account is obtained the technique is reliable.