CVE-2026-49373: TeamCity Perforce RCE – Patch to 2026.1

Technical summary

CVE-2026-49373 is a remote code execution flaw in TeamCity's Perforce integration layer. The vulnerability stems from improper argument construction in how TeamCity processes Perforce connection parameters (CWE-88: Argument Injection). An attacker with authentication credentials and appropriate role permissions can inject malicious payloads into Perforce connection settings, leading to command execution within the TeamCity application context. The attack surface is the administrative or project-level settings interface where Perforce repository connections are configured. No network-level authentication bypass is required; the vulnerability assumes the attacker has already cleared TeamCity's authentication.

Business impact

Organizations relying on TeamCity for CI/CD automation face direct operational disruption and data compromise. Successful exploitation allows an attacker with TeamCity credentials to gain code execution on build infrastructure, potentially compromising build artifacts, secrets stored in CI/CD pipelines, and downstream systems that consume build outputs. Supply chain integrity becomes a critical concern if malicious code is injected into software builds. The exposure is primarily internal (requires authenticated access) but carries high severity due to the privileged position of CI/CD systems in development workflows.

Affected systems

JetBrains TeamCity versions before 2026.1 are affected. Organizations should verify their deployed version via the TeamCity Administration > About section or by checking application startup logs. The vulnerability applies to all deployment models (on-premises, cloud-hosted, or containerized) running affected versions, regardless of whether Perforce is actively used—the flaw exists in the codebase before user interaction.

Exploitability

Exploitation requires valid TeamCity credentials with permissions to create or modify Perforce integration settings. This typically means users with Administrator, Project Administrator, or equivalent build configuration roles. No public exploit code has been added to CISA's Known Exploited Vulnerabilities catalog, indicating limited evidence of active weaponization in the wild at this time. However, the straightforward nature of argument injection in configuration interfaces means that exploitation by insiders or compromised accounts is feasible without sophisticated tooling.

Remediation

Upgrade TeamCity to version 2026.1 or later. JetBrains has addressed the Perforce argument injection in this release. Organizations unable to upgrade immediately should restrict TeamCity access via network segmentation, limit the number of users with Perforce integration configuration privileges, and monitor TeamCity logs for unusual Perforce connection modifications or administrative activity.

Patch guidance

Verify your current TeamCity version in Administration > About. If running a version before 2026.1, consult JetBrains' official download and upgrade documentation for your deployment architecture (server, agents, plugins). Test the upgrade in a non-production environment first to ensure compatibility with custom plugins or integrations. Patch both the TeamCity server and any connected agents, as the vulnerability may impact build execution context.

Detection guidance

Monitor TeamCity audit logs for changes to Perforce connection settings, particularly modifications from non-standard administrative accounts or during unusual hours. Check for suspicious command syntax in Perforce configuration fields if logs capture configuration content. Network-level detection is limited since this is application-layer injection; focus on endpoint monitoring of the TeamCity process for unexpected child process spawning or outbound connections during Perforce integration operations. Review recent Perforce connection test or build execution logs for error messages indicating command injection attempts.

Why prioritize this

Despite a CVSS score of 7.1 (HIGH), this vulnerability ranks for immediate patching due to its position in CI/CD infrastructure and the high-trust environment in which TeamCity operates. The requirement for authentication substantially reduces the attack surface compared to unauthenticated RCE, but the confluence of privileged infrastructure access and potential supply chain impact justifies rapid remediation. Organizations should prioritize this above non-critical findings but may sequence it after critical unauthenticated RCE vulnerabilities affecting the same asset.

Risk score, explained

The CVSS 3.1 score of 7.1 reflects: Network-exploitable attack vector (AV:N), low attack complexity (AC:L), requirement for low-privilege authentication (PR:L), no user interaction (UI:N), and contained scope (S:U). The impact ratings—High confidentiality, Low integrity, No availability impact—indicate data exfiltration risk without full system compromise or denial-of-service capability. The score appropriately balances the authentication barrier against the severity of code execution in a trusted build environment.

Frequently asked questions