JetBrains TeamCity software contained a flaw in its handling of Perforce connection settings that allowed an attacker to execute arbitrary code on the server. The weakness is identified as CWE‑88 and permits remote code execution, which could compromise the confidentiality, integrity, and availability of the TeamCity installation and any affected build processes.

The vulnerability affects all releases of JetBrains TeamCity prior to version 2026.1. Administrators using any unsupported or older version should consider the product in a vulnerable state until the upgrade is applied.

The CVSS score for this flaw is 7.1, indicating a high severity potential. EPSS data is not available, and the weakness is not listed in the CISA KEV catalog. The likely attack vector is over the network, where an attacker with the ability to configure Perforce connection settings can inject malicious values that are executed by the TeamCity service. Successful exploitation would give the attacker full control over the TeamCity host.