JetBrains TeamCity EUVD-2026-42912

Exploitation requires the attacker to control a build agent that connects to the TeamCity server and submits the agent-reported data used to render the cloud profile page, meaning agent-level access/authorization is a prerequisite (consistent with PR:L). The payload only executes when a user with access to the cloud profile page - typically an administrator - actually views that page (UI:R). Limiting factors: victim interaction is mandatory, the attacker must already be able to influence agent-reported data (not anonymous), only TeamCity versions before 2026.1.2 are vulnerable, and exploitation yields browser-context script execution rather than direct server takeover.

The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N, 7.3 High) reflects a network-reachable but authenticated flaw requiring victim interaction; the C:H/I:H rating is aggressive for an XSS and likely reflects the administrative context of the cloud profile page rather than direct server compromise. Real-world urgency is tempered by two gating factors captured in the vector: PR:L (the attacker must already be able to make an agent report data) and UI:R (a privileged user must load the specific page). No EPSS score, KEV entry, POC, or SSVC decision data was provided, so exploitation-likelihood signals are absent; the balance of evidence points to a genuine but not drive-by vulnerability - meaningful in environments where agent registration is loosely controlled, lower priority where agents are trusted. Note the C:H/I:H impact conflicts with the S:U (no scope change) rating for a browser-executed XSS - verify actual impact scope with the vendor.

An attacker who can register or compromise a build agent configures it to report data containing a crafted JavaScript payload; the payload is stored by TeamCity. When an administrator opens the cloud profile page, the script executes in their authenticated session, allowing the attacker to steal session tokens or perform administrative actions as that user. No public exploit code has been identified at time of analysis.