What is the CVSS score of EUVD-2026-48253?

EUVD-2026-48253 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of JetBrains TeamCity are affected by EUVD-2026-48253?

JetBrains TeamCity contains a critical code execution vulnerability affecting versions before 2026.1.2 and 2025.11.6, allowing privileged users to execute arbitrary code through Git VCS root…. A patch is available.

How to fix or mitigate EUVD-2026-48253?

Within 24 hours, immediately restrict administrative access to VCS root configuration settings and audit all Git VCS roots for suspicious or unauthorized configurations. Within 7 days, implement compensating controls including enhanced monitoring of VCS root modifications, review audit logs for configuration changes, and restrict TeamCity administrator roles to essential personnel only. Within 30 days, upgrade to patched versions (2026.1.2 for current release or 2025.11.6 for earlier branch) immediately upon availability, and conduct a comprehensive audit of all build artifacts and deployments that occurred while the vulnerability was present.

JetBrains TeamCity EUVD-2026-48253

| CVE-2026-65907 CRITICAL

Code Injection (CWE-94)

2026-07-23 JetBrains

GHSA-rxg7-r9m5-jj25

RCE Code Injection Teamcity JetBrains

9.1

CVSS 3.1 · Vendor: JetBrains

Severity by source

Vendor (JetBrains) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.1 CRITICAL

Requires project-admin rights to edit VCS roots (PR:H) but is network-reachable with no interaction; code execution escaping the config context to agents justifies S:C and full C/I/A:H.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (JetBrains).

CVSS VectorVendor: JetBrains

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 23, 2026 - 14:04 EUVD

Analysis Generated

Jul 23, 2026 - 13:16 vuln.today

CVE Published

Jul 23, 2026 - 12:28 cve.org

CRITICAL 9.1

DescriptionCVE.org

In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible

AnalysisAI

Code execution in JetBrains TeamCity (before 2026.1.2 and 2025.11.6) allows a privileged user to run arbitrary code through Git VCS root configuration, mapping to CWE-94 code injection. The CVSS 3.1 score of 9.1 reflects a scope-changing flaw (S:C) that requires high privileges (PR:H) but no user interaction, meaning an attacker with rights to configure VCS roots can escalate into code execution on the CI/CD infrastructure. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was self-reported by JetBrains.

Technical ContextAI

TeamCity is a continuous-integration and build-automation server that connects to source repositories through 'VCS roots' - configuration objects that define how the server checks out code (URL, branch, authentication, and Git-specific parameters). CWE-94 (Improper Control of Generation of Code / Code Injection) here indicates that attacker-influenced Git VCS root parameters are interpreted as executable code rather than inert data, so the server or its build agents execute injected commands during VCS operations. The only CPE provided (cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*) is unbounded on version, so the affected range must be read from the advisory text (before 2026.1.2 in the 2026.1 line and before 2025.11.6 in the 2025.11 line). The scope change (S:C) in the CVSS vector is consistent with server-side configuration leading to execution in a distinct security context such as a build agent.

RemediationAI

Vendor-released patch: upgrade to TeamCity 2026.1.2 or 2025.11.6 (or later) depending on your release line; these are the fixed versions cited by JetBrains at https://www.jetbrains.com/privacy-security/issues-fixed/. Until the upgrade is applied, reduce exposure by tightly restricting who holds project-administrator / VCS-root edit permissions, since PR:H means only privileged users can trigger the flaw - audit and remove unnecessary VCS-configuration rights and review recently created or modified Git VCS roots for suspicious parameters. As additional hardening, limit network access to the TeamCity server to trusted operators and isolate build agents so that a compromised agent cannot pivot into production; note that tightening VCS permissions may block legitimate project admins from self-service repository configuration, so coordinate with development teams before enforcing.