JetBrains TeamCity EUVD-2026-33380

Exploitation requires network reachability to the TeamCity Server's HTTP interface and the ability to issue requests to its build status functionality; per CVSS PR:N/UI:N, no authentication and no user interaction are needed. The affected product must be TeamCity at a version below 2026.1 on the current branch or below 2025.11.5 on the 2025.11 branch - patched and JetBrains-managed Cloud instances upgraded past those versions are not exploitable. Real-world impact is limited by what the TeamCity server can actually reach from its network position: an instance segmented away from cloud metadata services and internal admin panels yields far less useful SSRF than one deployed flat in a cloud VPC with default IMDSv1 enabled.

The CVSS vector AV:N/AC:L/PR:N/UI:N indicates a network-reachable, low-complexity, unauthenticated attack with no user interaction - a textbook profile for opportunistic mass exploitation against internet-exposed TeamCity instances. Confidentiality impact is rated High while integrity and availability are None, consistent with SSRF used to read internal resources (e.g., cloud IMDS endpoints, internal admin panels, source repos) rather than to modify state directly. EPSS and SSVC data were not supplied, and the CVE is not listed in CISA KEV at time of analysis, so there is no public exploitation telemetry to corroborate the inherent risk; however, TeamCity has a strong history of post-disclosure mass exploitation (e.g., CVE-2024-27198), so defenders should treat the inherent CVSS profile as a credible priority signal even absent EPSS/KEV confirmation. No public exploit is identified at time of analysis, but unauthenticated SSRF on a build server is typically straightforward to reverse from a patch diff.

An external attacker scans the internet for exposed TeamCity servers and sends an unauthenticated HTTP request to the build status surface with a crafted target URL pointing at the cloud provider's instance metadata service. The TeamCity server fetches the URL with its own network identity and returns the response content to the attacker, exposing temporary IAM credentials or internal-only admin endpoints. No public exploit is identified at time of analysis, but the low attack complexity makes reproduction from the patch diff likely once a fix is published.