CVEFinder.io

CVE-2026-100254

⚠️ high
Summary

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings

CVSS Score
8.8
High
EPSS Score
0.5
Exploit Probability
Published Date
2026-09-30
First Seen: 2026-10-04
πŸ“Š Relative Risk Intelligence

This CVE is High Risk - more severe than 80.8% of all 369,977 vulnerabilities in our database.

#70,985
Top 25% most severe
Severity Percentile
🎯 CISA SSVC Assessment Updated: Sep 30, 2026
πŸ” Exploitation Status
None
No known exploits
βš™οΈ Automatable
NO
Requires human interaction
πŸ’₯ Technical Impact
Total
Complete system compromise possible
SSVC data provided by CISA
Last Modified 2026-10-06
Source NVD πŸ”—
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE IDs (Weakness Types)
CWE-78

πŸ“¦ Affected Products 2

Vendor Product Status Affected Versions
jetbrains teamcity Affected
< 2025.11.8
jetbrains teamcity Affected
> 2026.1 < 2026.1.4

πŸ”— References 1

https://www.jetbrains.com/privacy-security/issues-fi...
Vendor Advisory

πŸ”— Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-100253 ⚠️ high 8.8 0.4 In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the... 2026-09-30
CVE-2026-100255 ⚠️ high 8.1 0.4 In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password rese... 2026-09-30
CVE-2026-63077 β›” critical 9.8 10.7 In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent pollin... 2026-07-27
CVE-2026-65906 ⚠️ high 8.8 0.4 In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible 2026-07-23
CVE-2026-59793 ⚠️ high 8.8 0.3 In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration 2026-07-10
CVE-2026-59794 ⚠️ high 7.3 0.2 In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported data 2026-07-10
These CVEs affect the same products