CVE-2026-65906 is a high severity (CVSS 8.8) flaw in JetBrains TeamCity. A Kotlin DSL sandbox escape allowed code execution. JetBrains lists it as fixed in 2026.1.2 and 2025.11.6. Upgrade your TeamCity server and review who is allowed to change build configuration.
What's affected
- Product: JetBrains TeamCity.
- Affected versions: before 2026.1.2, and before 2025.11.6 on that branch.
- Fixed versions: 2026.1.2 and 2025.11.6, per the CVE record.
- Weakness: CWE-94 code injection.
- Severity: CVSS 3.1 8.8, vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. A low privilege account is required.
How to check if you're exposed
The TeamCity version is shown in the web interface footer and on the Administration, then Diagnostics page. The server also exposes it in its API:
curl -s https://your-teamcity-host/app/rest/server/version
Depending on your settings this call may need authentication. Compare the result with 2026.1.2 or 2025.11.6. Also work out who holds permission to create or edit projects and build configurations, because the vector says a low privilege account is enough.
What to do now
- Check the TeamCity server version in Administration, Diagnostics.
- Upgrade to 2026.1.2 or 2025.11.6, or a later release, following JetBrains' upgrade guide.
- Review project and configuration editing permissions and remove them from accounts that do not need them.
- Review recent changes to Kotlin DSL settings and versioned settings repositories for edits you do not recognise.
- Rotate secrets that the TeamCity server can read if you suspect misuse.
Why it matters
TeamCity lets projects define builds in Kotlin code, called the Kotlin DSL. That code is evaluated on the server, so TeamCity runs it inside a restricted environment. A sandbox escape means code written for that DSL could get out of the restrictions and run with the server's own rights.
A CI server is a valuable target because it holds deploy keys, tokens and signing material, and it can change what ships. The vector needs a low privilege account, so the exposure depends on how many people can edit build configuration. JetBrains' page does not report exploitation and the CISA KEV flag is false.
Try it yourself
A CI server is long lived, so version drift is easy to miss. This walkthrough shows continuous monitoring catching it.
Click through it at your own pace, or open it full screen.
Quick check
Who can trigger this?
The vector requires a low privilege account with the ability to supply Kotlin DSL content, so it matters most where many people can edit build configuration.
Where is the official fix list?
JetBrains publishes fixed security issues on its privacy and security page, which is the source listed in the record.
Sources
Last reviewed: 19 October 2026.
