JetBrains TeamCity: Administrator account takeover via password reset
Summary
JetBrains TeamCity, a build management and CI/CD server, contains a flaw in its password reset process. An attacker can take over an administrator account, which gives full administrative control of the build server. The vulnerability is reachable over the network without authentication (PR:N), so the main exposure question is whether the TeamCity web UI and its reset page are reachable from untrusted networks.
Affected
- TeamCity before 2026.2
- TeamCity 2026.1.x before 2026.1.4
- TeamCity before 2025.11.8
- Older branches (for example 2025.07 or earlier): Unknown.
Fixed in
- Upgrade to TeamCity 2026.2 or later
- Upgrade to TeamCity 2026.1.4 or later (2026.1.x branch)
- Upgrade to TeamCity 2025.11.8 or later (2025.11.x branch)
Workaround
- No vendor workaround found. Patching is the only documented fix.
- Until patched, restrict access to the TeamCity web UI to VPN or internal networks.
- Review administrator accounts and recent password reset activity in the TeamCity logs.
Exploitation
- Exploited in the wild: Not known.
- CISA KEV: Not listed.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- EPSS: 0.4 percent (score recorded on 2026-10-21).
- Public proof of concept: None found in searches; this does not prove none exists.
Our recommendation
- Patch TeamCity to 2026.2, 2026.1.4 or 2025.11.8 as applicable, and patch CVE-2026-100253 (sandbox escape via versioned settings Kotlin DSL) in the same release batch.
- Check whether the TeamCity web UI or its Reset password page is reachable from the internet; if so, treat this as high priority, otherwise medium.
- Review admin accounts and password reset logs for suspicious activity.
- Verify the CVSS score against the live NVD record, as sources differ (9.8 with AC:L versus 8.1 with AC:H).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- JetBrains fixed security issues (CVE reference) www.jetbrains.com
- OpenCVE CVE-2026-100255 app.opencve.io
- Tenable Nessus plugin 362481 www.tenable.com
- ismalicious.com CVE-2026-100255 (EPSS, KEV, SSVC) ismalicious.com
- JetBrains TeamCity 2026.1.4 release notes www.jetbrains.com
- JetBrains TeamCity 2025.11.8 release notes www.jetbrains.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:51.
Original description (NVD)
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.