CVE-2026-100253
HIGHCVSS 8.8/10EPSS 0.43%
Last modified
CVE-2026-100253 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL. EPSS estimates a 0.43% chance of exploitation in the next 30 days.
Description
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Jetbrains | Teamcity | < 2025.11.8 |
| Jetbrains | Teamcity | >= 2026.1, < 2026.1.4 |
References
- https://www.jetbrains.com/privacy-security/issues-fixed/Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-100253?
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL
How severe is CVE-2026-100253?
CVE-2026-100253 has a CVSS score of 8.8/10 (HIGH severity). The EPSS model estimates a 0.43% probability of exploitation in the next 30 days.
How do I fix CVE-2026-100253?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-100243Improper Neutralization of Input During Web Page Generation …6.1
- CVE-2026-100244Exposure of Sensitive Information to an Unauthorized Actor v…7.5
- CVE-2026-100245Improper Neutralization of Input During Web Page Generation …6.1
- CVE-2026-100248The Rattadan Cosmowarp smart contract before 56c6147 can hav…8.4
- CVE-2026-10025IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 …9.8
- CVE-2026-100251Wormhole.app as deployed before 2026-08-22 misconfigures the…6.5
- CVE-2026-100254In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 a…8.8
- CVE-2026-100255In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 a…9.8
- CVE-2026-100256In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structura…7.8
- CVE-2026-100257In JetBrains YouTrack before 2026.2.18991 sSRF via stored XH…4.3
- CVE-2026-100258In JetBrains YouTrack before 2026.2.18991 missing authorisat…4.3
- CVE-2026-100259In JetBrains YouTrack before 2026.2.18991 improper access co…4.3
Are you affected by CVE-2026-100253?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST