JetBrains TeamCity EUVD-2026-33379

Exploitation requires the attacker to craft a request that injects script into the TeamCity keyword filter parameter and to deliver that link to a user who is already authenticated to the target TeamCity instance (UI:R - victim must click the malicious URL). No attacker authentication is required (PR:N per CVSS), but the impact is realized only within the clicking victim's browser session and privilege level, so damage scales with the victim's role (an administrator victim is worst case). Limiting factors: the payload is reflected (non-persistent), so it must be socially engineered per-victim rather than passively triggered; the TeamCity web UI must be reachable by the victim; and instances not exposed to link delivery or with users trained against untrusted links are materially harder to exploit. Affected only on TeamCity versions before 2026.1.1.

Signals are mostly consistent and point to a real-but-conditional issue rather than a mass-exploitation emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N, base 8.2) reflects network reach and no privileges required, but hinges on UI:R - a victim must click a malicious link - and the elevated score is largely driven by the scope change (S:C) plus C:H. Corroborating this, SSVC rates Exploitation as 'none', Automatable as 'no', and Technical Impact as 'partial', and EPSS is 0.01% (3rd percentile), indicating negligible observed or predicted exploitation. It is not on CISA KEV and no POC is referenced. Note a tension worth flagging: the CVSS assigns C:H for what is a reflected XSS, which is arguably generous - the practical confidentiality impact depends on whether a high-privilege TeamCity user can be lured into clicking, so treat C:H as the vendor's worst-case rather than a guaranteed outcome. Net: patch on a normal cadence; this is not a drop-everything item absent evidence of targeting.

An attacker crafts a URL to the TeamCity server containing a malicious script payload in the keyword filter parameter and sends it to a logged-in TeamCity user, for example an administrator, via email or chat. When the victim opens the link, the reflected script executes in their authenticated session and can steal session tokens or perform actions in the TeamCity UI on their behalf. No public exploit code is identified at time of analysis, and success requires the low-complexity but user-interaction-dependent step of the victim clicking the link.