CVE-2026-111096
published 2026-10-15CVE-2026-111096: In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible
PriorityP426medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
0.18%
7.4th percentile
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 stored XSS in the classic build log was possible
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jetbrains | teamcity | < 2026.2, 2026.1.4, 2025.11.8 | 2026.2, 2026.1.4, 2025.11.8 |
| jetbrains | teamcity | < 2025.11.8 | 2025.11.8 |
| jetbrains | teamcity | >= 2026.1 < 2026.1.4 | 2026.1.4 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
JetBrains TeamCity prior 2026.2/2026.1.4/2025.11.8 Build Log cross site scripting (EUVD-2026-102149)
vuldb·2026-10-15·CVSS 6.7
CVE-2026-111096 [MEDIUM] JetBrains TeamCity prior 2026.2/2026.1.4/2025.11.8 Build Log cross site scripting (EUVD-2026-102149)
A vulnerability was found in JetBrains TeamCity and classified as problematic. This impacts an unknown function of the component Build Log. Such manipulation leads to cross site scripting.
This vulnerability is traded as CVE-2026-111096. The attack may be launched remotely. There is no exploit available.
It is suggested to upgrade the affected component.
GHSA
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible
ghsa_unreviewed·2026-10-15
CVE-2026-111096 [MEDIUM] CWE-79 In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 stored XSS in the classic build log was possible
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-10-15
Published