CVE-2026-59793: TeamCity Perforce Integration Arbitrary File Access – CVSS 8.8

Technical summary

CVE-2026-59793 is an arbitrary file access vulnerability in TeamCity's Perforce VCS integration mechanism. The vulnerability is classified under CWE-73 (External Control of File Name or Path), indicating a path traversal or file-handling weakness in the Perforce plugin. The attack vector is network-based and requires low complexity; it demands valid credentials (PR:L) but no user interaction. The CVSS 3.1 score of 8.8 reflects high impact across confidentiality, integrity, and availability, though the availability impact likely stems from the potential to corrupt or delete files rather than cause direct denial of service. The vulnerability exists in the abstraction layer where TeamCity translates user requests into Perforce operations.

Business impact

Compromise of sensitive files stored within or accessible through TeamCity instances poses significant business risk. Attackers could exfiltrate proprietary source code, build artifacts, deployment credentials embedded in configurations, or intellectual property. In regulated environments, unauthorized file access may trigger compliance violations (SOX, HIPAA, PCI-DSS depending on data classification). If integrity is affected—files modified or deleted—build reliability and software supply chain integrity are compromised, potentially resulting in tainted releases or operational downtime. Organizations relying on TeamCity as a central CI/CD hub face elevated risk if this vulnerability remains unpatched.

Affected systems

JetBrains TeamCity versions before 2026.1.2 are affected. All deployment models (cloud-hosted, on-premises) running vulnerable versions are at risk. The vulnerability requires Perforce integration to be configured; TeamCity instances using only Git, SVN, or other VCS providers are unaffected. Any TeamCity instance accessible to authenticated users (including those with minimal permissions) becomes an attack surface.

Exploitability

Exploitability is moderate to high in practice. An attacker must possess valid TeamCity credentials, which is a meaningful barrier but not insurmountable—credentials may be obtained through phishing, insider access, or compromised employee accounts. Once authenticated, the attack requires no special tooling or interaction; a simple API or UI interaction can trigger file access. The attack is deterministic and repeatable. However, the vulnerability is not known to be exploited in the wild (KEV status is false), suggesting either recent discovery or limited public awareness. No active weaponization has been documented.

Remediation

Upgrade TeamCity to version 2026.1.2 or later. This version contains fixes to the Perforce integration that properly restrict file access to authorized paths and users. Before upgrading, identify all TeamCity instances in your environment using Perforce integration and verify compatibility with your Perforce server version. Disable the Perforce integration on non-critical instances if an upgrade timeline extends beyond 30 days. Implement least-privilege access controls within TeamCity to minimize the blast radius of compromised accounts.

Patch guidance

Apply the TeamCity 2026.1.2 security update as soon as practical within your change management process. Verify the update addresses the Perforce integration specifically. Test in a staging environment first to ensure no breaking changes with your Perforce server configuration or existing build pipelines. Monitor JetBrains security advisories for any updates indicating incomplete fixes or related issues. If you are on an older release train (e.g., 2025.x), consult JetBrains documentation to determine the supported upgrade path and any intermediate patch requirements.

Detection guidance

Monitor TeamCity server logs and audit trails for unusual file access patterns, particularly queries targeting sensitive configuration directories, credential stores, or source repository paths outside normal build operations. Inspect Perforce server logs for anomalous read or write operations initiated by TeamCity service accounts, especially access to files not associated with active build jobs. Check for unexpected API calls to the Perforce integration endpoints. If your security monitoring integrates with TeamCity, configure alerts for failed authentication attempts followed by successful logins from the same source. Review TeamCity user account activity before and after July 10, 2026 (publication date) for any suspicious access.

Why prioritize this

HIGH severity (CVSS 8.8) driven by high confidentiality and integrity impact, combined with low attack complexity and authentication-based access vector. While KEV status is false and weaponization is unobserved, the vulnerability is immediately exploitable by any insider or attacker who obtains valid credentials. Organizations with sensitive source code, regulated data, or critical build pipelines should treat this as urgent and prioritize patching within 14 days. Those with mature identity and access controls limiting TeamCity user counts can extend the timeline slightly but should not delay significantly.

Risk score, explained

The 8.8 CVSS score reflects the combination of network accessibility (AV:N), minimal attack prerequisites (AC:L), requirement for valid authentication (PR:L), and comprehensive confidentiality/integrity/availability impact (C:H/I:H/A:H). The authentication requirement prevents casual exploitation and reduces the score from a potential 9.8, but the ease of execution once authenticated and the breadth of potential file access justify the high rating. The lack of scope change (S:U) indicates the impact is confined to the vulnerable component itself, not wider system elevation.

Frequently asked questions